Have a lot of those metrics in place & keep the formula private. If leaking the formula into the public seems probable, then make formula polymorphic: certain weights differ based on RNG seeded by hashcode of game's internal ID. This doesn't fully protect from gaming the formula, but it makes automated influence unreliable and hits botters business. It's a questionable approach, but I think it hits botters way more than it hits legitimate reviews, because in legitimate reviews there are zero expectations how certains reviews contribute to overall score. Such expectations can only exist, and thus can only be ruined for malicious actors. This definitely has some limits of how much it can contribute to overall score, because RNG shouldn't be able to make a good game with legitimate reviews not reach good overall score. Unreliable means that botters were able to take 1000$ from client and bump their game, but then they take 1000$ from their next client and their shit suddenly doesn't work anymore for unknown reasons and client is mad and botters decide to quit their business and move to something else.