I am using WordPress Automatic Platform Optimization, and it works perfectly for URLs without a query string like https://www.domain.com/random/. These pages get cached and served to users which are not logged in.
They’d have to hardcode that query string in to stop it from being bypassed. Given that it’s “sort”, I don’t think that’s a safe one to cache for all APO users.