[apologies, reposting, seems like the original attempt at this one got lost]

Mod services can easily generate labels based on PDS (server) as well as DID, so you can block users by server as well as by individual identity.

A blocked user can try to migrate to a new PDS, but if a widely used mod service blocks them, no one using that mod service and following that set of labels will see them, regardless of which server they migrate to. Likewise, PDSes that subscribe to that mod service and labels won't let them join.

They can create a new DID and their own PDS, but that incurs a cost similar to creating a new fediverse instance.