> "out of spec" means that it is out of specification. It is literally not specified.
That's not what it means at all. Being out of spec means the spec explicitly stating that a request with a body should be reject. If the spec does not state that a request with a body should be rejected then you are not required to reject a request which packs a body.
If there was an utter ban, then it would be against specification and not compliant, not merely out of specification.