Moreover, the most hilarious thing here is that Turnstile is easily bypassed by "patchright" (patched playwright runtime) + xvfb + good residential IP pool.
So it's hurting real users and not protecting against bots.
That is still more of an ask than what most IoT volumetric attacks can do. It’s like saying Turnstile is bypassed by paying a human to do the captcha.