They can; Apple (and others) have implemented Private Access Tokens (PATs) for this.
https://blog.cloudflare.com/eliminating-captchas-on-iphones-...