Just because there is no alternative, doesn't justify the means.

If they cannot figure out a way to block malicious actors, they cant just randomly block every second request - though that would also work just as well. Malicious people would just try again, and the collateral often wont. Same result.