I checked for a specific default value (server-generated), so having no-value or a random value both wouldn't work.

It is pretty effective in most cases at evading most bots and dumb attempts, but it's also trivial to defeat if you're being targeted.