Hacker News Reader

Very naive question: can a bad actor just use a VPN to get around this?

Yes

Not if you also block VPNs

Fingerprinting VPNs is quite hard so this isn’t a reliable solution.

There's plenty of services available that provide reliable VPN and proxy detection. Every large corporation uses them.