The problem is the whack-a-mole game with hackers and script kiddies. It used to be the case that banning known colo ASNs was enough to get rid of nuisance by STROs, then there was a flood of hacked routers being used for DDoS that was really annoying to get rid of, and then came "residential IP" VPNs and commercial VPNs, both of which get routinely abused by AI scrapers and frankly, the AI scrapers are a worse enemy than the skiddies of 10 years ago. They ruin everything.

And you as a site operator can't really tell apart skiddies, griefers, AI scrapers and legitimate users apart any more.