One thing I learned from my experience in security is that sometimes instantly responding to a threat may be counterproductive because you may be reacting to a

One thing I learned from my experience in security is that sometimes instantly responding to a threat may be counterproductive because you may be reacting to a form of a honeypot - it is used to determine whether their newest iteration would bypass your detection or not. Similarly, large online game operators tend to do bans for bot systems in waves rather than incrementally to avoid signalling precisely what tipped off their systems. I don’t know if the dynamics make sense for Facebook’s adversarial users or not.