REALITY disguises itself during the TLS handshake and certificate delivery, returning certificates and initial data that appear to be from a legitimate website during the handshake, making the TLS connection and access to "major" HTTPS websites difficult to distinguish. The GFW risks accidentally blocking legitimate websites if it wants to block them.
The honest answer: they sometimes do, increasingly so, and that's why this is an active arms race rather than a settled problem.
Below is why an SNI↔IP correlation check is harder than it looks, why Russian TSPU and the GFW don't apply it universally, and how REALITY's design tries to defeat it anyway.