Neither. Nowadays it is only one part of a large scoring system using a bunch of device and user fingerprinting, and it's primary use seems to be tarpitting bot

Neither. Nowadays it is only one part of a large scoring system using a bunch of device and user fingerprinting, and it's primary use seems to be tarpitting bots who score low on the other metrics (as well as any users unfortunate or privacy-conscious enough to be misidentified as a bot).