Allowing every tool can used explicitly is annoying. Perhaps, an option "Users are allowed to install THE_TOOL" (allow Maven, disallow everything else) would be a compromise between convenience and safety.

This is especially problematic for pipeline where the tools name resides in SCM creating (often undesired) binding between the SCM and Jenkins configuration. Admin then have no idea if it is safe to delete/rename tool installation without inspecting all SCMs that can/are built on the instance. (This is annoying even without pipeline when the tool name is in jobs configuration, though it is easier to check and fix).

Another problem is a pipeline reusability. If every developer adheres to "local" naming conventions for tool installers, pipelines will not work for other people as "GitHub + Maven" sample does not work out of the box until "M3" is configured (I guess there is no guarantee it is maven at all).

I suggest to create a mechanism to install a tool, identified by a name admin can not affect (${TOOL_NAME}-${VERSION}) and prefer using these "recommended names" from jobs and pipeline scripts. Note that admin will always have an opportunity to override the name with explicit tool installation but there will be a guarantee that Maven-3.3.9 exists.