One aspect that shouldn't be lost - the implicit framing of the platforms being "under attack" by the bots is wrong - the bots are likely a net positive for the platforms - they're very much complicit with the fraud, or at least condone it. They sell views and clicks - if bots create more views and clicks, so be it. It's the advertisers who bear the cost.
Taking Facebook as an example:
Creating an account, linking Oculus Quest to it and leaving the account dormant - accounts locked en masse.
US account that logs in from Indonesian IPs, never posts anything, likes 5000 random things ranging from a shampoo to a cafe in a small Ohio town, to the new shirts of an Albanian soccer club - in Facebook's view that's a perfectly legitimate account.