Changing User-Agent bypasses bot protection?

It seems that just changing the user agent of a request is bypassing bot protection on my website.

This is properly blocked:

while true; do curl  'https://api.merklemap.com/v1/certificates/google.com'; done

while true; do curl  'https://api.merklemap.com/v1/certificates/google.com'; done

while true; do curl  'https://api.merklemap.com/v1/certificates/google.com'; done

while true; do curl  'https://api.merklemap.com/v1/certificates/google.com'; done

This passes with a 100% success rate?

while true; do curl --user-agent 'ok'  'https://api.merklemap.com/v1/certificates/google.com'; done

while true; do curl --user-agent 'ok'  'https://api.merklemap.com/v1/certificates/google.com'; done

while true; do curl --user-agent 'ok'  'https://api.merklemap.com/v1/certificates/google.com'; done

while true; do curl --user-agent 'ok'  'https://api.merklemap.com/v1/certificates/google.com'; done

Am I missing something?

Thanks.