There's always CAPTCHA bypasses if you're willing to pay, there've been sites operating for decades that will take a captcha URL and spit out the appropriate response by just feeding it to humans. This is just a different way to make you pay - and arguably to something of less ill-repute, buying more U2F keys once yours get banned.
This provides effective rate limiting and you can still get every key you automate banned very easily.
This provides effective rate limiting and you can still get every key you automate banned very easily.