The mouse might be one signal but Instagram is almost certainly looking at way more than that and feed it to some ML-based abuse detection.

They likely have entire teams working on this, plus adversarial teams trying to break their own detection systems.

I'm blocking as much tracking as I reasonably can and they still caught it within a few days. So I doubt this failed because of one obvious browser API. It is probably a combination of behavioural signals that made the account look automated.