They are bots that use the bot API but connect as a regular user rather than as a bot user. This gives them access to features they should not have, according to the terms of use of the API.

I see. Discords fault then. Why allow this? But I probably know the answer. They have an Electron interface and no real way of detecting this.

Both users and bots use the same API. All that's different is that Bots have 'Bot' in their auth headers. That and some endpoints are limited to just Bot accounts.

Bot on normal account detection is based on outlier usage statistics from regular accounts, like too many requests or something.

All Ripcord requests (to discord) actually have Ripcord in their User Agent header, discord can immediately detect it's usage, they have not banned anyone for using the software specifically, only for the same reason they have been banning Selfbots (Users ending up spamming the API)