Personally I think that limiting the stats to just HTML pages is a credible stat on which you could claim that "bots passed human traffic". I don't care about bots downloading other types of content.

The most important thing is to link to your methodology, which Cloudflare's CEO did in this case.

Contrast a human user with a naïve bot implementation when they come across an SPA. The human user will load the HTML once then fetch plenty of JSON as they use it. The bot will fetch the HTML and move on. If you filter by HTML only, then an extended human session lasting hours would be counted as equal to a bot immediately bouncing.