There is not-insignificant, if not huge group of site admins that take a "aha! more security therefore better!" approach and will just enable under attack mode

There is not-insignificant, if not huge group of site admins that take a "aha! more security therefore better!" approach and will just enable under attack mode (the 5s JS challenge) for everyone all the time. Some are a bit more savvy and will take a still rather ham-fisted approach of doing so for most countries. That's not uncommon with retailer websites that realistically only serve a single country, and therefore have good enough reason to challenge all others to deter automated traffic from compromised machines outside their market.