> Like, who is the employee at the insurance company who takes that call, and how do they decide what's just too risky, when there can't be much historical data on risk?

I suspect that it is the underwriters, who are responsible for assessing risks and determining what constraints and requirements must be met to claim insurance. Their work can be highly mathematical and, other times, they will just look at the underwriting guidelines and say "No, we won't let you test a homemade parachute on a living human because your team are not professional parachute manufacturers with valid indemnity insurance we can mitigate our risk against."