Rate limiting by IP mitigates this somewhat. 6r/m per IP is probably reasonable. You’d need over a 1000 bots to hit 1M in 24 hour period.