I just read it, and I don't see any contradiction here. IMO, he's recommending simple and direct anti-bot methods to web admins specifically because it's better than relying solely on Cloudflare etc for all bot blocking. He never recommends making un-appealable access control decisions based on third-party lists, and specifically recommends caution on methods that might potentially impact innocent users. Seems perfectly consistent to me.