But what prevents someone from using Anthropic own detection system to train a watermark-scrubber?

Seems like this would only catch the most unsophisticated cases.

Rate limits, presumably.

Most of the people posting unedited LLM content all over the internet are unbelievably lazy.

I don't think so, I think most LLM content is bot generated and amending bots to remove watermarkers would be trivial if the bypass is trivial.

You are just pointing out the very visible single cases. But the mass of low-visible content is much higher and more dangerous (like propaganda bot-farms). If a social media platform adds watermarker checks the bots would implement bypasses ASAP.