As long as their not executing JS, they don't really need a PoW to stop them, though. Something much simpler that requires executing JS would do.

i might at any rate set my PoW to be relatively cheap, which would do for anyone not executing JS.