Issue with GA4 counting bot traffic from Germany

According to GA4, Over the past 12 months my website has received thousands visits from Germany. I believe this is bot traffic because it is all direct and all the sessions are 0 seconds. Looking at Cloudflare, I can see that tons of blocked traffic from Germany, but GA4 is still counting visits from users in that country.

Two Questions:

  • How would I create a filter in Cloudflare that block all bot traffic from Germany, but allow valid visits through?

  • Is it possible that GA4 is still counting the bot traffic that Cloudflare says it is blocking?