anubis does its thing by making you waste your cpu cycles and then giving you a cookie, if you use that cookie for subsequent requests then you're free to browse the site. it might in theory slow down dumb scrapers that don't save that state and parallelize the mass scraping via multiple ip addresses (since without the cookie they'll have to solve the challenge for each request) but if one's making a targeted attack for one specific site, they don't do any of that. it should be trivial for a bad actor to solve the challenge once and use the cookie, like a regular user would. anubis only slows down scrapers that scrape all sites indiscriminately and don't expect it, once you know it's there then it's easy to bypass (and if you can afford to scrape the entire site you can surely afford to get past anubis once).