Maybe it is enough to include some css/js which is served without cache and is loaded after all user visible css/js is loaded. Make it small enough to not cause too much bandwidth for the server and legitimate clients. Then anyone who doesn’t hit that CSS file gets banned.

Possibly. I've noticed however that if people default to reader view they don't always pull the CSS. Seems to vary by client software. I'm weird enough to just stick with visual inspection and add characteristics when botters get too clever. Playing with the botters is almost as fun as Megabonk.