It is both. It is the PSU freaking out, which is the expected and planned reaction of hardware pieces. Once in "safety shutdown" mode, you need to either disconnect the PSU for a few seconds or reset a trip switch which is usually on the back¹. Very cheap PSUs might not trip, and just leave the equipment malfunctioning due to insufficient current.

Worse still, they might enter a "spin-up, brown-out, power-down, power-up, spin-up, brown-out..." cycle that occasionally even self-solves and goes on to a proper boot. What is happening here is that the PSU isn't tripping and the equipment is subjected to unplanned wear and tear. In such a case, I'd advise on replacing the PSU altogether. It makes little sense to run through hoops to accommodate what is a misbehaving power supply to begin with. And while you're at replacing the PSU, get a more powerful one, which solves the initial problem.

However, hard disks are a special case, since they are known to have much greater spin-up requirements. So some hard disks (and motherboards) have provisions to handle this by delaying the spin-up, using jumpers that delay the spin-up by a fixed amount of time, or supporting PUIS (also here) or staggered spin-up via backplane signaling. Jumperless solutions require a suitable motherboard, that is capable of sending the appropriate signal to the hard disk (pin 11 of the SATA interface, implemented by WD and others). The software is either left to the user or sometimes implemented in the BIOS.

Theory

It is both. It is the PSU freaking out, which is the expected and planned reaction of hardware pieces. Once in "safety shutdown" mode, you need to either disconnect the PSU for a few seconds or reset a trip switch which is usually on the back¹.

Real world

Very cheap PSUs might not trip, and just leave the equipment malfunctioning due to insufficient current. This is some manufacturers' interpretation of "improving" the ATX design, reducing the need for resetting the PSU in case of a "temporary" overload. Real ATX supplies will be able to operate at maximum peak for a short time, this peak being above continuous operation spec, without tripping and without being damaged. Everyone wins. Poorly designed units of certain manufacturers that shall not be named simply never trip; when used reasonably, they are identical to real ATX PSUs and cost less.

When used unreasonably, they might go up in flames, or enter a "spin-up, brown-out, power-down, power-up, spin-up, brown-out..." cycle that occasionally even self-solves and goes on to a proper boot. What is happening here is that the PSU isn't tripping and the equipment is subjected to unplanned wear and tear. In such a case, I'd advise on replacing the PSU altogether. It makes little sense to run through hoops to accommodate what is a misbehaving power supply to begin with. And while you're at replacing the PSU, get a more powerful one, which solves the initial problem.

However, hard disks are a special case, since they are known to have much greater spin-up requirements. So some hard disks (and motherboards) have provisions to handle this by delaying the spin-up, using jumpers that delay the spin-up by a fixed amount of time, or supporting PUIS (also here) or staggered spin-up via backplane signaling. Jumperless solutions require a suitable motherboard, that is capable of sending the appropriate signal to the hard disk (pin 11 of the SATA interface, implemented by WD and others). The software is either left to the user or sometimes implemented in the BIOS.

This has nothing to do with PSUs, but might explain how, in a certain setup, a 350W PSU might not trip when powering eight hard disks whose combined spin-up power is (I'm using a random number) 400W. That's because the full power drain never materializes, and the hard disks go up two at a time, each drawing a huge current for a few fractions of a second before settling to the normal operational current. Replace the motherboard with one that doesn't handle (or hasn't configured) staggered spin-up, and boom.

• the PSU cannot be sure about who's draining current. One power line might connect to up to four Molex connectors and the 12V/5V lines aren't designed to carry information. It could be done but you'd need to essentially reengineer both the PSU and all hardware likely to need such a feature.
• denying power to one device might defeat the purpose of booting the whole system. Or lead to potentially disastrous results. Think what would happen if a RAID unit booted one (or two!) disk short due to it having been "current denied".
• if the extreme current requirement stemmed from a hardware fault, the whole system is faulting and therefore the current policy of shutting everything down is, to my eyes, the safest line of conduct. Keep in mind that large, too-important-to-fail systems will be built differently and with huge redundancies, so in those scenarios a limited shutdown is also the best response, and it might not even happen because the faulting unit isn't requiring more current but simply not starting at all (circuit protection and breaking directly on all powered parts. In old high-end IBM AS/400 systems you could short circuit a drive and the system would go on working while one drive bay was going up in flames and smoke - I saw it happen. The unit was logically and electrically disconnected from the backplane, but this didn't prevent it from going on burning, of course; but with enough money even that can be prevented).
• on the gripping hand, it's economically unsound - such a smart PSU would cost much more than a dumber, sturdier, more powerful PSU which would be simpler to build and likely to last longer, and would solve the same problem equally well.

• the PSU cannot be sure about who's draining current. One power line might connect to up to four Molex connectors and the 12V/5V lines aren't designed to carry information. It could be done but you'd need to essentially reengineer both the PSU and all hardware likely to need such a feature.
• denying power to one device might defeat the purpose of booting the whole system. Or lead to potentially disastrous results. Think what would happen if a RAID unit booted one (or two!) disk short due to it having been "current denied".
• if the extreme current requirement stemmed from a hardware fault, the whole system is faulting and therefore the current policy of shutting everything down is, to my eyes, the safest line of conduct. Keep in mind that large, too-important-to-fail systems will be built differently and with huge redundancies, so in those scenarios a limited shutdown is also the best response, and it might not even happen because the faulting unit isn't requiring more current but simply not starting at all (circuit protection and breaking directly on all powered parts. In old high-end IBM AS/400 systems you could short circuit a drive and the system would go on working while one drive bay was going up in flames and smoke - I saw it happen. The unit was logically and electrically disconnected from the backplane, but this didn't prevent it from going on burning, of course; but with enough money even that can be prevented).
• on the gripping hand, it's economically unsound - such a smart PSU would cost much more than a dumber, sturdier, more powerful PSU which would be simpler to build and likely to last longer, and would solve the same problem equally well (actually, having more current at its disposal, and working farther from full capacity, it would solve that particular problem better).

Updates

To clarify my question: What I'm interested in is why the common result is system shutdown instead of a safe denial of power to the device which would overload the system? USB power management protects against such a scenario [...] I'm really surprised there isn't some sort of power management logic built into PSUs like motherboards have for managing USB power distribution.

USB is a communication standard between devices that are more "intelligent" than what is required from your average hard disk (granted, the computing power on a hard disk is nothing to be sneered at - some of them can run Linux).

But the problems here are many:

• the PSU cannot be sure about who's draining current. One power line might connect to up to four Molex connectors and the 12V/5V lines aren't designed to carry information. It could be done but you'd need to essentially reengineer both the PSU and all hardware likely to need such a feature.
• denying power to one device might defeat the purpose of booting the whole system. Or lead to potentially disastrous results. Think what would happen if a RAID unit booted one (or two!) disk short due to it having been "current denied".
• if the extreme current requirement stemmed from a hardware fault, the whole system is faulting and therefore the current policy of shutting everything down is, to my eyes, the safest line of conduct. Keep in mind that large, too-important-to-fail systems will be built differently and with huge redundancies, so in those scenarios a limited shutdown is also the best response, and it might not even happen because the faulting unit isn't requiring more current but simply not starting at all (circuit protection and breaking directly on all powered parts. In old high-end IBM AS/400 systems you could short circuit a drive and the system would go on working while one drive bay was going up in flames and smoke - I saw it happen. The unit was logically and electrically disconnected from the backplane, but this didn't prevent it from going on burning, of course; but with enough money even that can be prevented).
• on the gripping hand, it's economically unsound - such a smart PSU would cost much more than a dumber, sturdier, more powerful PSU which would be simpler to build and likely to last longer, and would solve the same problem equally well.