This debate has been going on for at least a couple of decades. I remember back in the Usenet days, when AOL and other early ISP users first started showing up in droves with whacked out untraceable bang paths that people were trying to sort out technical solutions, usually involving some servers tarpitting some domains, with the inevitable consequence that valid users (by whatever definition any given Usenet group had) were blocked.
In a way, AI bots aren't any different than the spam problem on fax machines and email; universal low-barrier delivery meets large scale programmatic swill. AI allows complexity that earlier spambots couldn't dream of, when the most sophisticated way of defeating filters was spelling "porn" as "pr0n" and a bit of header fuckery. In the end there is only two ways to go; either do what filtering you can and accept some degree of false positives, or go to identification systems that will, one way or the other, compromise anonymity, because make no mistake, once you start storing any kind of data linking an account to an actual human being; biometric, picture ID, phone number, mailing address or whatever, it won't take long for the court order to show up demanding you hand over all the de-anonymized account data to find the person distributing child porn, drugs, or calling their local political representative dirty names.
