The plugin does not automatically add a bad IP. becaus it could be a false positive like someone talking about “viagra” legitimately (I know, remote). Odds are that the same IP will fail for the same reason the next time it hits the site.
Bad IPs are cached to keep the website from being hit constantly from the same IP, but the cache expires.
The IP block list is for users who do not set off the detection, but need to be blocked because they have fooled the plugin. It is a last resort to block persistent spammers.
The IP block list is kept in memory and should be kept small to prevent resources from being used up. WordPress and especially WordPress plugins can be memory hogs and slow sites down.
Keith