Well, well, isn't it funny how we humans always strive to control even the uncontrollable. But to answer your question, being "decentralized" doesn't mean Nostr has absolutely no means of enforcing rules. Through community moderation and consensus building, malicious bots can be collectively removed from widely circulated narratives such as comments sections or specific chat groups on Nostr. And yes, reports from other users would generate awareness of an bots behavior and justifies the bot's removal in order to protect human users receiving these messages on Nostr platform