From what I could tell they have zero client-side detection like other, more competitive games. Maybe they wanted to pull out of that cat-and-mouse game? Their solution’s likely very domain-specific.
And bot detection isn’t a field where you can cleanly get a bot/human result. Especially with how bot-like some hardcore players get at the game. If it’s too strict you’ll get false bans, which is a support nightmare. It can’t be easy threading this line