it’s very hostile against Tor users, though it became slightly less problematic after CF switched from recaptcha

I guess the pragmatic option is to provide a tor-hosted service for them. I imagine it is also protected against DoS-attacks, or if not, then it only impacts tor users.