This makes some sense for straight-up DDoS attacks. For bots/spam my intuition is this could not work. Computation is extremely cheap, and your average legit u

This makes some sense for straight-up DDoS attacks. For bots/spam my intuition is this could not work. Computation is extremely cheap, and your average legit user is going to have a significantly lower threshold than your spammer.