Here is the thing: there are a lot of ways to detect VPN usage. IP logging, tracking cookies, device fingerprinting, VPN IP blacklists, you can even detect VPN usage if you know how to inspect the TCP/IP MTU/MSS configuration on packets arriving on a machine. Just to name a few.
Here is the other thing: all of the detection techniques have documented countermeasures that can be used to bypass detection.
Are VPNs detectable? Yes. Can malicious actors thwart detection? Yes. Can any site really block a user on a VPN? Not if the user knows what they are doing.