By no means do IPs translate to users.
A student dorm for example may expose just 1 public IP that is NAT-ed to hundreds of individuals.
-> you ban it, you ban the whole dorm
One individual may possess multiple IPs (especially with IPv6, e.g. I have 1024 IPs). Also, IP at school, IP at work, IP on phone's 4G, etc.
-> if you base security on the premise that 1 user = 1 ip, people can (and will) exploit
Some ISPs assign dynamic IPs, meaning if you restart your router you get another one
-> not only the user gets away, but that IP you just banned will be assigned to someone innocent in a minute.
tl;dr IPs are just a number, stop using them for identification.
Same with prefixes. 90% of exploits may very well come from China, but that doesn't mean 90% of Chinese people are exploiters. Banning China as a whole would be racist (#triggered)