The problem is that the attacker isn't using a phone, they are using some type of specialized hardware. I still think it is possible with some customized varia

The problem is that the attacker isn't using a phone, they are using some type of specialized hardware. I still think it is possible with some customized variant of RandomX. The server could even make a bit of money by acting as a mining pool by forcing the clients to mine a certain block template. It's just that it would need to be installed as a browser plugin or something, it wouldn't be efficient running within a page. Also the verification process for RandomX is still pretty intensive. so there is a high minimum bar for where it would be feasible.