* I'm not sure how practical hardware banning would even be for XIV without the use of kernel level anticheats, or tying to the Trusted Platform Module (which on top of the other "why we don't use an anticheat" issues basically means "Regarding the End of Windows 10 Support" incoming, seeing that you'd basically need to mandate Windows 11 to utilize that feature effectively).

* Yes, they're paying a sub, and practically speaking, I expect that's why the enforcement is lukewarm. It's something I've observed since all the way back in the Diablo II days (where bots would be routinely banned but nothing would be done to prevent their return or shore up the game's security to more effectively bar them). Distasteful as it is, I'm actually not sure if these live service games (apart from the ones with stupid amounts of P2W or lootbox slime) actually add up financially without "dark matter" sources of income like this (certainly it was the case for Diablo II since it was buy to play; for XIV there is the fact that competition with WoW more or less prevents sub rates for either from going up to keep up with costs/inflation, and I'm really not sure what other solutions there are there).

* As I've opined in the past in a place or two: it also allows them to have less urgency on certain other parts of the game: e.g., there's less need to worry about slow rates of crystal/shard acquisition vs use when the MB bots basically act as vendors for crystals. MB bots also likely function to some or other degree as a gil sink in a game that suffers from a severe lack of them (i.e., the bots get banned and take all the gil with them).

At least they've taken care of some of the worst offenses (like how back in ARR, bots used to send you a friend request, so that you'd be forced to listen to them for longer, as you wouldn't be able to simply add to blacklist with the friend request pending ...).