Wouldn't the client being open source mean botting is essentially impossible to control?
Jagex has made some improvements to their bot detection mostly through detecting if you’re playing on an “approved” build of RuneLite (the primary repo) in the past year or so, but this method went undetected for so long that many have maxed their accounts.
I think a large percentage of the community is buying botted gold, but random people botting to get 99 mining or runecrafting or whatever is relatively rare (and relatively sucessfully detected) compared to gold farms.
People have been decompiling and deobfuscating the RuneScape client since 2005.
Since it's written in Java it's not hard to do.
They do have some pretty smart ways of easily detecting bots. They do live streams of them teleporting bots to a world and killing them all before banning them.
It actually quite hard to build a reliable bot for RS.