A: They can't get away with it. In case after case, judges have been ruling that merely posting the terms on the website is not sufficient. Rather, there must be some manifestation of assent by the user.
The two contrasting practices, mere positing of terms on a web page versus requiring an "I Agree" click, are rather inelegantly called "browse-wrap agreements" and "click-wrap agreements," respectively. The former term comes from pre-internet days when a notice on the wrapper of a software disk stated that by opening the plastic wrapping, you agree to the licensor's terms and conditions.
The consistent pattern of the cases is that browse-wrap agreements are unenforceable because there is no evidence that the user agreed to the terms, but click-wrap agreements are enforceable, even if -- as is probably the case in 99% of clicks -- the user has not actually read the terms and conditions, as long as he had the chance to do so before the booking.
For example, in In Re: Online Travel Company (OTC) Hotel Booking Antitrust Litigation, a federal court in Texas upheld Travelocity's mandatory arbitration clause in its terms and conditions because, "it was impossible to complete a transaction on the Travelocity website in the absence of affirmative assent to the User Agreement."
The potential downside of always requiring "I Agree" at the end of the registration or booking process is that, conversely, the user can click all around the website beforehand without being bound by any legal restriction. Therefore, a Tinder-type sign-up button at each login is a good alternative if you are concerned with possible misuse before booking occurs.
Further, some websites, such as those of banks and stock brokerages, require you to take two other steps: to scroll to the end of their document before clicking, and in a few cases, type in your name at the end. I could find no precedents requiring such scrolling or typing, so my advice is that clicking "I Agree" at the end of the registration or booking process is sufficient, as is requiring consent at each login.