What if you make MFA mandatory. Normal users should have little issues with that despite the increased friction but bots would struggle with this.