This is pretty broad criticism, but you are at least right that there is no sound principle on which to protect a website from "automated" interaction.