Is Managed Challenge now too easy for bots to get past?

We have a site behind Cloudflare that's getting hit by a lot of bot IPs spread across the world (the vast majority of the IPs are outside of our country). We've got all the normal bot-blocking rules active (including allowing good bots - these IPs coming in aren't faking good bot agent strings before you ask - they're just faking normal browsers) and they don't help.

We did a test: added a security rule to do a managed challenge for all IPs coming in from outside our country and let that run for a few days. It turns out foreign IPs for bots got past that Managed Challenge and ended up continuing to hit our backend! This was confirmed when we changed the Managed Challenge to a Block and the bot traffic significantly dropped to not much above normal levels.

So has Managed Challenge now been "solved" by bots (e.g. by them using Playwright or some other solution) and is useless to protect sites any more?