Does anyone know how they're detecting this? User agents can be changed and JS APIs can be modified with very little effort. Short of making something absolutel

Does anyone know how they're detecting this? User agents can be changed and JS APIs can be modified with very little effort. Short of making something absolutely insane and forcing everyone to go along like they did with SafetyNet on Android, I don't see a way for this to actually work...