No, because you're framing it like they're blocking or challenging every user that comes to their site. Instead, when 90% of your malicious traffic comes from VPNs/TOR, it makes way more sense to just block or challenge those specifically even if it causes an inconvenience on the ones who use those services in a non-malicious way.