I wouldn't consider what we do evasion really. We are using real tokens that you have received from your browser as a result of browsing the web. Any good anti-bot will have enforcement for abuses of that token.
Indeed, it would likely be classed as a violation according to your own ToS.
It's a delicate matter as we all deploy personal automations that break ToS without us really giving it a second thought. But as a commercial endeavour, it feels brazen, I'm sorry to say.