— The bot would not have to "see" the DOM itself, just the visual representation of it
— Seeing the real DOM (ie a button element so you can click) is very hard with js
— Insofar as running user agent scripts
— Yes if he were to roll a custom client he should use that
— I have seen phantomjs in the wild for non-test solutions like scraping
— User scripts does what he needs
— They can circumvent csrf