It is enforced by the add_target methods:
>>> target_files = repository.get_filepaths_in_directory('repository/metadata')
>>> repository.targets.add_targets(target_files)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/vlad/projects/tuf/tuf/repository_tool.py", line 1786, in add_targets
    raise tuf.Error(message)
tuf.Error: '/home/vlad/projects/tuf/tuf/repository/metadata/timestamp.json' is not under the Repository's targets directory: '/home/vlad/projects/tuf/tuf/repository/targets'
>>> 

Not sure if repository maintainers might want this to be a general-purpose method.  For example, getting file paths in non-targets directory.  Should it also raise an exception here?