I've got a web app that receives over 1000 requests every second, of which 1-2 are optimistically humans. These bot blocking pages are not for show.

My argument wasn't that they are for show, but rather that the false positive rate is way too high and the incentive seems to tune them ever upwards.

Also context here, 1000 requests/second is doable on modest hardware as is. Mitigations with a false negative rate of 10% get that down to 100 req/s, which is doable on even a Rasperry Pi. You don't need to block every request but those 2 in order to have a usable site.

We can imagine some rough contours of the problem - require being logged in to do any expensive query, serve static pages otherwise, rate limit accounts that do many expensive queries (especially without buying anything), and project the login page with some mild proof of work to prevent credential stuffing.

From what I've seen, Amazon comes much closer to this (I've only ever seen a captcha when logging in), whereas other web stores just keep cranking that false positive rate up and up.