isn't JA4 also useless because it is so easy to spoof tls. For eg. cycletls for nodejs etc..

It will probably be useless one day. In practice, it is still useful today though not for this attack.