From what I've read, it seems like a lot of the companies monitor API calls and will posion responses for suspicious traffic. This basically means they'll modify the output to be harmful to the scrapper.

Outside of that they can block accounts/IPs, limit what is returned (just the final answer vs all reasoning steps, etc.). However it's a bit like all cyber security and an evolving game of cat and mouse.