People catching some cases doesn't mean others aren't succeeding unnoticed.

A privacy model that depends on "admins would probably notice something fishy" is not a model users should rely on.

All it takes is one person to notice for a #fediblock notice to propagate. The more instances, the harder it is to hide.

With OP's perspective services like Cloudflare, Akamai and anyone else trying to mitigate malicious traffic should just give up.

This extremely nihilistic view is not productive, and ignores that 99% success in mitigating bad actors is much better than no mitigation.