Question that I've been wondering, can't attackers record human sessions and use it to attack a website to bypass cloudflare ?

They can. They have already figured out a lot of what cloudflare is looking for and have figured out how to bypass it. (according to the article) Which is why protection is trying something else. I suppose this is why every website wants me to login with my google account (which I never use)