Bots don't [currently] execute JavaScript or follow complicated redirects.

They don't now, but enough "high value to the bots" pages turning on JS or complicated redirects will simply result in the bot authors adding JS execution or redirect following so they can continue "botting" the sites they want to scrape.

It's a hole with no bottom. Each one-up on the anti-bot side will eventually be handled on the bot side.

That's not true . A lot of bots are just headless chrome instances .

They have been doing it for years: https://roundproxies.com/blog/bypass-bot-detection/

This level of (mis)undertanding perfectly explains that crapware.