Alternate interpretation assuming incompetence instead of malice: they _do_ ban thousands of bots a week, but their security staff isn’t aware of this particular attack vector and so they haven’t banned these particular ones (or the attackers have some way of evading analysis, honeypots, …).