This very clearly is a protocol issue.

With AtProto, the algorithm and effective centralization means that there really isn't any way to deal with the bots unless BlueSky itself deals with the bots.

With Mastodon, there's no way for bots to get visibility and it's extremely easy to just cut out the instances that allow them.