Designing a site to not be affected by bots is fixing the problem. Blocking things that are bot-like, poorly, with no technical understanding, is a kludge, not a fix.
Which is exactly what Cloudflare does, although most people would make a distinction between degrading an experience and outright causing something to not work at all.
Building a WAF that has zero false positives and zero false negatives is impossible. All we can ask is that the companies that build WAFs be responsive, but they also need accurate bug reports with sufficient information to identify the variable.
That's already been established. My point is that there exists a tradeoff. Blocking a small number of legitimate users can be worth the benefits blocking the bots.
Except the Cloudflare firewall is just so goddamn dumb. It considers all of Asia a "bot", anybody who uses Linux or has a tracker blocker. I've had this complaint from several regular people who don't even have an adblocker.
