Yeah, even if the hardware can validate perfectly that it’s not running any botting software, there’s nothing stopping someone from spinning up a farm of these machines and using a central server as a hypervisor for them all. It’s impossible to determine if your user is a bot.