This thread has brought a lot of confirmation to what I've spent the last few weeks mulling over. Even down to the recording of movements to compare against the client's mouse movement and attempting to see if the client's mouse movement can easily be identified. Always suspected mouse movement was sent to the server, but never came across any physical proof until reading this thread.
There's a project we'll call "Cat and Mouse" that I've been thought experimenting with for a while to help with this *exact* problem. While part of me has been wanting to keep it to myself I think I'll share here where it feels most relevant and maybe even open source it at some point if it makes sense to. Recording mouse data on a large scale is difficult (consent, incentive, etc) so the point of this project would be to do it in both an ethical and incentivized manner.
Basically, there are 3 objectives to "Cat and Mouse".
Collect human mouse data (and maybe keyboard or other forms of behavior down the road) via a fun / incentivized game designed to create situations that affect behavior. Some examples would be size of click area, distance of movement, importance of accurate clicks, moving vs fixed targets, whether the movement is rushed, etc
Create a bot that attempts to go undetected playing the game vs that large sample size of human data <---- Mouse
Create a bot detection system that the bot is constantly trying to beat <---- Cat
With a large sample size of human data and several iterations of the bot detection system (via machine learning?) the bot should be able to get better and better at replicating human inputs (mouse, keyboard, etc).
I'm sure there's a lot more to it than just what I've described as "solving the problem" and I'm purposely keeping a lot of the more interesting bits to myself, but coming across this thread kind of sparked the need to share the idea