> On top of that, the user's client can do any kind of algorithmic bot detection they want.

Bot traffic is sometimes detectable only at scale.