It failed because the web browser lets the content know where the mouse cursor is, with absolute precission. It shouldn't.

The mouse might be one signal but Instagram is almost certainly looking at way more than that and feed it to some ML-based abuse detection.

They likely have entire teams working on this, plus adversarial teams trying to break their own detection systems.

I'm blocking as much tracking as I reasonably can and they still caught it within a few days. So I doubt this failed because of one obvious browser API. It is probably a combination of behavioural signals that made the account look automated.