He's most likely just not very smart.
I looked into it and so far as I can tell it works off a blacklist system, rather than any sort of automatic analysis (eg. TCP or MTU fingerprinting). If you set up a "residential proxy" in the form of a home VPN, it won't be detected. It also means the detection is only as good as whatever their backlist source is. If it's a niche provider, it might not get picked up at all.
Where are you finding free residential proxies?
> Tried my CGNAT home connection - flagged. My phone connection - also flagged.
Why does that mean they're doing a bad job? Since both are CGNAT, you're sharing the IP with lots of other people, and it's not unlikely that one of your network neighbors is infected.