No. Heruistics/“fortune tells” are 100% what is required for good security.

Because if all you are doing is flagging known threats? Then that means you are perpetually vulnerable and exploited.

False positives are a thing. In fact, flagging a device that intercepts and routes all traffic to weird random ass servers is a very good thing.

The answer is to note the false positive and then release an updated list that permitlists it.