That's a pretty weak solution in my opinion. Mobile OSes and browsers use a model based on permissions. There's zero reason for a Discord "bot" to be able to send information to arbitrary endpoints without informing the user about them up front. Collecting ID and threatening to sue is a half assed response. Or more cynically ...

> (user tokens can't be used for bots, third party clients are a risk)

... how convenient. So sorry, but we need to restrict what you can do for your own protection. Where have I heard that one before?

> Privacy is not something easily understood

"Privacy" isn't what needs to be understood here. "Don't run arbitrary code" is what applies; it applies everywhere whether you like it or not.