Are IP exclusions enough to stop click fraud on their own?

Rarely. Exclusions work well against a known offender on a fixed address and they cost nothing, so they are worth setting up. They do nothing against traffic that changes address, and they are unavailable in Performance Max. If your wasted spend has not moved after adding addresses, the list is working correctly on a problem that was not the expensive one.