Doesn't a user that has Ghostery/NoScript render this completely useless?
Sift Science also has both Javascript and server side APIs. See https://siftscience.com/docs/rest-api for info on the REST API. This allows companies to send all relevant transaction and behavioral data to Sift even for users who don't execute Javascript.
EDIT: I just checked out what you mean, since Sift utilizes Javascript code for their api call to determine risk, I agree with you...it would render their pattern check ineffective for the Javascript api integration...they need to run server side code, which Sift offers in their REST API.