Designing a site to not be affected by bots is fixing the problem. Blocking things that are bot-like, poorly, with no technical understanding, is a kludge, not a fix.
It is definitely always possible.
> may not be affordable
You hired the wrong person / people, then.
> may degrade the overall user experience
Which is exactly what Cloudflare does, although most people would make a distinction between degrading an experience and outright causing something to not work at all.
WTF?
Building a WAF that has zero false positives and zero false negatives is impossible. All we can ask is that the companies that build WAFs be responsive, but they also need accurate bug reports with sufficient information to identify the variable.
> Designing a site to not be affected by bots is fixing the problem.
Bots footprint is minimal and shouldn't affect your site performance.
- scraping & content theft
- spam & fake engagement
- DDoS attacks
- Ad fraud
a kludge might be better than none. And it's an easy kludge (for the site owner - a checkbox in cloudflare).
The fault lies with cloudflare implementing a lazy bot detector.