The architecture of lemmy means that the API is completely open. Bots do not need to even scrape or do anything with the website, they can do everything through the API. it doesn't matter how simple the layout is. Lemmy is open source as well and the API is fully documented and available to the public.
Lemmy devs are going to need to do some additional work to differentiate bot/human accounts. In the meantime its going to be on the admins to identify and remove/ban these accounts.