It depends how their user's configure the settings. You can use Cloudflare and effectively turn all blocking off very easily. There is a reason their customers tend to leave it on, or in my case, increase the default security level. Sorry Tor users, but 100% of the Tor traffic I've gotten has been malicious WP vulnerability scanning