This happens via simple lists of IP addresses, no? I.e. the VPN has a limited number of exit IPs and once it’s known who they belong to, they’re easy to block?