The argument against 403 is that the server might not get to the resource at all, so it doesn't get a chance to refuse the response. A router with filtering capabilities might also terminate the connection and return 451 if the target server is censored and won't be reached. (wether that's practically likely to happen—e.g., at the Great Firewall, or for ICE seizures—is a different matter entirely)