but I would assume there’s an arms race going on behind-the-scenes between Cloudflare and the bot developers

No. CF lost years ago, and the checks can be bypassed easily. It's just that it blacklists ips generating insane traffic but there is a lot of margin