- Can't ban by referrer (domain).
- Can't ban by request.
- Can't ban user agents whose names contain punctuation.
- IP ban list is unsorted.
The rest of the plugin's features and implementations are very good, but once set up the ability to easily maintain an effective ban list is essential, and this doesn't quite cut it right now.
There is an old plugin that does all of this well ('ttc security plugin'), which might be well worth a look from the developer of 'Better WP Security' to see how banning could be better implemented.