So far it's actually not. Though it is getting harder.

I suspect we'll get integrity attestation or tokens before it becomes an unsurmountable problem to block bots.