Privacy and Bot defense are opposite ends of the same fulcrum. If you permit privacy, the site/service has to trust users to behave and follow the rules. If you track users, then the users have to trust the site/service owners not to abuse that trust. There isn't really an in between.
So if you want privacy, you have to accept poor and sometimes insecure services.
So if you want privacy, you have to accept poor and sometimes insecure services.