From what I understand, modern malicious actor/bot detection generally speaking (i.e. not specifically Cloudflare and/or FT) is a multi-layered approach based on multiple elements of a web request, ranging from things like historical traffic patterns from a particular IP space, down to specific things about the browser, claimed user agent vs. actual indicators, behind-the-scenes Javascript computational challenges, etc. Google search says they can also track things like mouse/pointer movement. So it's not necessarily the binary clicking or not-clicking of the box, which can obviously be done by machines (e.g. even non-maliciously when websites want to do automated QA testing), but how/when the clicking occurs in conjunction with everything else. Also sometimes the background stuff decides it has a strong enough signal that your request is legitimate and the request gets approved without you even having to click on anything at all.