Ofc a timer will be set per connection and has to be only one part of a whole global and probably fine-grained connection policy !

Their only purpose compared to such timer, is, in their current state to create a hard dependency on exactly the web engines of the whatwg cartel and do exclude low end hardware (this does create a barrier of entry for new hardware or small hardware).

At least, they could have had the decency to design some "HTTP" specs to de-couple those maths challenges from those abominations which are the web engines of the whatwg cartel (maybe that's the case).

Yep, I could bet that a lot of BOTs are now based on those abominations (and probably using neural nets). You also have click farms with real humans.

There is so much wrong there... well Big Tech...