I appreciate the decision to not run proof of work challenges. They not only punish all customers , they especially punish outliers with excessive challenges : long challenge factors costing minutes, and false positives so the challenges are presented many times a day, or where the challenges interferes with multi-screen oauth steps.

I haven’t seen an installation where the operator is tracking customer impact. They check the logs and say “see , we’ve screened 80% of the AI bots”. Meanwhile , among the 80% of bot traffic is a few percent of customers who are aggressively being punished without the operator being aware.