Which isn't a web of trust. it is just an "allowlist". Humans are vulnerable to sybil attacks too.

An allow-list with transitive trust is a web of trust. And I said "use a web of trust", not "use an allow-list", because I really did mean "web of trust".

And sure, they can be, if they adopt patterns that allow it. I can also find plenty of counter-examples. I don't think "humans are less vulnerable to sybil attacks than automated systems" is a weakly-defensible stance at all.