I use Cloudflare for my site and it's exactly as you said. See https://developers.cloudflare.com/waf/reference/cloudflare-challenges/ for details. To my knowledge, website admins can't disable these challenges if an IP has displayed suspicious behavior.