First, I don't think there ever will be a limitation of 1 (or even small n) account per card. This excludes big corporate clients, media networks, etc. who have legitimate reason to have more than one account but would still pay from the same account. I'd bet a buck these are the accounts that most likely to actually pay for X. It would be unwise to gate them out.

Second, if detecting bots would've been as easy as taking only a day (even a few days) worth of posting then there would never be a need to paywall the whole of X. I believe it's because it's hard (either objectively hard, or just expensive for X) to detect bots Musk considers such a disruptive measure.

Third, cards are probably not a good verification mechanism. More so if there's not card-to-account limitation. Stolen cards don't have to be used directly. Money can be laundered elsewhere and then used with a good card. It is an obstacle but probably only for small/ad-hoc operations. Big bot nets will hardly be impacted by this.