I use cloudflare to block bots and agents and they were able to scan still which is quite annoying.

The site claims to be by cloudflare (didn't find a reverse link to confirm), so maybe they use their own little backdoor.