> If you skip at the server it’s trivially detectable.

I don't see how. If I built a touchscreen-using robot, DD couldn't detect it. If some middleman business had a boiler room of 10 robots, it would be the same. All network requests identical to the official app. And if you think they'd look at IP addresses or something, how would they tell it apart from a college campus or a CGNAT gateway?