A client that followed the trap used to be marked for 24 hours by its IP and by its TLS fingerprint. A TLS fingerprint identifies a TLS library, not a client, so one scraper could get every client with the same library, such as every curl of a Linux distribution, treated as a trap follower on that site.
Now a trap follower is marked by its exact IP and by its TLS fingerprint only within its network (/24 for IPv4, /64 for IPv6). The fingerprint is marked on its own only when it follows the trap from at least 3 different networks within 24 hours and isn't one of the fingerprints the edge sees most often in your site's normal traffic. Marks still expire after 24 hours.
IP allow rules, zone or global, now exempt a client from the trap: it is never marked, and an earlier mark doesn't apply to it. Verified crawlers were already exempt.