Damn you're right, didn't think of that. But isn't that only when they're applying for a student pilot certificate? Whereas a Discovery is basically a "sight seeing" flight most of the time.
It's the "log flight time" issue in the AOPA article
@Capt. Geoffrey Thorpe linked. Here's the analysis (I'm not saying I agree with it, just that this is what it the analysis is):
What requires TSA compliance is "flight training," defined as "instruction received from a flight school in an aircraft or aircraft simulator." There are exceptions including ones for recurrent training (and for aircraft marketing demo flights, but not Discovery Flights), but the definition of recurrent training says:
"Recurrent training means periodic training required under 14 CFR part 61, 121,125, 135, or Subpart K of part 91. Recurrent training does not include training that would enable a candidate who has a certificate or type rating for a particular aircraft to receive a certificate or type rating for another aircraft."
Theoretically, any recurrent training can be used toward another certificate or type rating for another aircraft, even just the pure hours (think commercial multi with a private SEL). Analogizing that to Discovery Flights, even if TSA says it's OK, since the logged time could be used toward a private certificate, the concern is, it requires needs TSA compliance to be logged.