If it's too difficult to guarantee end-users' devices are legitimate using other means then the alternative would just be more invasive fingerprinting and login

If it's too difficult to guarantee end-users' devices are legitimate using other means then the alternative would just be more invasive fingerprinting and login/paywalls. In addition to that any access restrictions would probably end up being less precise and thus cause more collateral damage. Which would also mean an increased amount of false negatives, leading to an increase in spammy content.