JA3/JA4 are useless now.

At best they identify the family of browser, and spoofing it is table stakes for bad actors. https://github.com/lwthiker/curl-impersonate

Slight correction: Spoofing it is table stakes for ever so slightly capable actors.

These will still help against the masses of dumb actors flooding your stuff.