Yes, it only work if the scraper, or rather scrapers cannot collaborate in a smart way (for example, doing Cookie sharing among themselves). That's limited by how Cloudflare page rule work, it don't really support anything that is too "dynamic", for example you can't concat/mix a Cookie with a Request date and then compare it, you can only check if there's a Cookie or Request date match a static value.

If you want something more powerful, there's also Cloudflare workers, which you can program to do whatever you want. But that one may cost you to run.

Also in my case, the scraper IPs are all over the globe, and almost each access is from a different one, so simple IP blocking don't work unless I block Vietnam, Brazil, Bangladesh, Argentina and the US etc (https://i.imgur.com/eWI5meM.png). But then, the scrapers might just go to another country next month.

Since I deployed those rules, the access from scrapers has almost stopped, while normal search engine crawls are almost unaffected. So it do still work for me, even if it's very rudimentary. But hey, security though obscurity it alone is not enough, but it sometimes do delay the attacks.