You can read ahead as to how this would go by looking at the CAPTCHA world, which unbeknownst to a lot of people left behind "click this image" as the actual test a long time ago and does a lot of behavioral analysis of mouse motions and stuff. Which is itself a constant arms race. Which I would still characterize as "advantage attacker" with regard to that aspect of it, CAPTCHAs still have at least some utility more from the other streams they have access to that are harder to fake, e.g., "this IP address is from a rentable service space and thus more likely to be a bot" sorts of checks.