I'm pretty sick of VPN users being punished. If I was going to hack your site I wouldn't use a VPN. I'd change the MAC address on my device and use some free cafe wifi.
Your MAC address is stripped at the first hop, so changing it does nothing. "Public" IPs, like those from a Starbucks, are also viewed poorly by anti-fraud systems.
VPN users get "punished" because of abuse from other VPN users. It's that simple.
Many modern OSes already randomize your MAC on untrusted WiFi
But that has no substantive effect on if a site wants to block you. They’ll do that based on other indicators like geo-IP so committing a crime with an IP where you live is not a great idea.
Which is exactly why sites treat VPN blocks as low trust/reputation
