I could but there are so many requests, like 30-50 per second, and even if I could cache the login page, I would still spend the bandwidth to send it back to each of those bots. So because of that, and because its not even the main lemmy.today site, I figured its OK to just return 403.
Server load has decreased to almost nothing on old.lemmy.today. During the years we have been online, more and more bots are scraping and now its just ridicolous. :)