Bots trying to brute force accounts may not have the API implemented like a real device may.

Sure, and my desktop computer just reports 100% battery level? Which can't be easily replicated by a static header in the bot?

This would be a silly thing to use to identify bots.