I’m totally guessing but I’m guessing it’s more similar to:

• Accessing from a business owned IP: +20% risk of abuse
• Accessing from C country: +10% risk of abuse
• The rate that you’re making requests: +5% risk of abuse
• Etc

Block if risk of abuse exceeded X%

I have no idea what I’m talking about, but I can’t imagine these companies aren’t using some pretty advanced detection of bot traffic