All anti-bot measures are inherently flawed, and if you overdo it, your false positives cause real harm by excluding actual people from using your services.

Not as in “1 out of 1000 legit requests get blocked” but “you’re going to block 100% of some person’s requests.”