Thanks for the feedback. I guess you misinterpret how successful I think the approach I laid out is. I was already aware of most of the points that you make, agreeing with all except 3 and 4.
Forgot to mention disabling referer where possible, which you can test with https://www.whatismyreferer.com