Oh! Now I wonder, if crowdsec could issue bans based on that

I'm not sure about JA3, but JA4 is basically fixed for all recent Chrome versions across many platforms so you definitely would not want to ban that. JA3/4s are basically just good at detecting people using python who are pretenting to be Chrome. And even that's patchable with packages like curl_cffi