I added a throttle for unauthenticated accesses to /tags on our public Mastodon instance. The rate limit of 50 in 10 minutes triggers quickly, and for the first time this year, our media cache usage has been slightly decreasing since.
A toggle to completely disable unauthenticated access to hashtag search would curb the current wave of scrapers quite effectively.