How I read it, they are claiming they have the authority under the law that gives each base commander authority to develop and implement their own level of force protection and base security.
If you don't know anything about the military it may make sense to have a one size fits all approach, but ita much more nuanced than that. There are many military bases that are about as "sensitive" as a college campus. Each military base commander sets their own policies.
Let's not forget that there are thousands of families that live on base, so even a toy drone bought on base, flown in backyard faces possibility of being charged.
Bottom line, I don't think they should be over riding the assessment made by local commanders.
'The Federal Aviation Administration (FAA) is using its existing authority under Title 14 of the Code of Federal Regulations (14 CFR) § 99.7 – “Special Security Instructions” – to address national security concerns about unauthorized drone operations over 133 military facilities.'
Seems pretty cut and dried doesn't it?
The offending bit of your aviation law
§ 99.7 Special security instructions.
Each
person operating an
aircraft in an ADIZ or
Defense Area must, in addition to the applicable rules of this part, comply with special security instructions issued by the
Administrator in the interest of national security, pursuant to agreement between the
FAA and the Department of Defense, or between the
FAA and a U.S. Federal security or intelligence agency.
[
69 FR 16756, Mar. 30, 2004]
Looks like it's been the same law since 2004 - the FAA makes the rules when they feel the need to.
Would it apply to toy drones? I doubt it as toys don't require FAA registration do they?
As you said, not all military bases are sensitive but this document doesn't apply to all military bases does it?