I think 404 does make sense in some ways. If an undesirable walks up to your house, sure you could shout at them to leave, but it might make more sense just to not answer the door. This has the added bonus of them not knowing whether you're actually not home or just not answering. A 404 is the equivalent of not answering the door.
Plus it's semantically correct, in the sense that those paths don't actually exist on your server anyways.
As a related thought, I would consider adding those paths to your
robots.txt, so that you can be certain you're only banning bots that are hitting those URLs maliciously, and not for example because bingbot found a link to them on some dark corner of the internet.
403 implies that the resource exists but the request will not be fulfilled, and 410 implies that the resource used to exist but does no longer. Neither of those are really true, so I think 404 is the most correct anyways.