Seems like it would be relatively simple no? They control the app itself? Wouldn't it be trivial to put a signature to the app and see the typing speed, user actions, etc?
Google is doing that, you know all those "I am not a robot" things? Those are made by google mostly and uses a lot of such signals. Its not just clicking the right things its also how you click etc.
The reason some of those just have a checkbox without a challenge is that they already are sure enough so how you move to click the box is enough then.