This is already a fact of life: Amazon, Cloudflare, etc all manage blocklists for common patterns in firewalls, and many compliance standards (e.g. SOC2) pretty much require you to enable them. Mistakes are sometimes made in these things, but fairly certain that liability is covered by the ToS.