How long before bots just use the chrome crypto API to make connections?

At scale it’s vastly more resource intensive than scripts, so it does stop the very cheapest layer of spammers, but not anyone in any way resourced or determined.

They already can. But they largely don't. We still get lots of really dumb requests that don't do basic hiding.