Many WAFs now block HTTP requests that will exploit it. Cloudflare (not what Reddit uses) does it for all customers automatically, for example.