I don't see how can a scalper could ez obtain a 3 years old account. OBVS if it's banned it's not elegible for trades on Steam, so it should be possible to add this requirement. Also, a two factors passwords require a Steam account linked to a phone number, again, something I don't think they are willing to waste time on.
As for the bot situation, I can see 1 key every 24 hours is better than 2 or more...
And no, I don't see how a regular user can be affected, I just have to link my Steam account like I did in many other sites.
But if for "affected" you mean all those users that have multiple account and play several times a day to have 10 free games, well, fuck them.