they could write a function that autoaims
at the nearest enemy sprite for example.
You can do this even for games were most processing happens server-side! You just need to analyse the display quickly enough.
You can even re-implement parts of the game AI to try to predict how bots will move. Not an easy task if you don't have access to the game's source code but if you log lots of gameplay time, you could apply machine learning techniques.
Is there any fundamental way to
protect people from doing this sort of
thing by designing your game code in a
certain way?
Don't forget that you can change the game itself, not just how it is implemented. For instance, use randomly-generated levels rather than static ones, use human players rather than bots, make your art/sprites more complex, make more use of audio, put a limit on how fast the cursor can be moved, add cooldown times to weapons, add hidden hazards, and so on.
