I don't think token is only the thing it comes to play here. If the company wants they can use various other techniques like fingerprinting, tls fingerprinting

I don't think token is only the thing it comes to play here. If the company wants they can use various other techniques like fingerprinting, tls fingerprinting and lot of thing. Its just a cat and mouse game. After few year I think hardware attention etc will come to play which can mitigate bot issue somewhat.