Some administrators set their server up to create a temporary holding room for new members and ask them to add a reaction to a message, or do a CAPTCHA, but that still falls apart if someone does all that manually then uses their account as a bot. If you're interested, there are plenty of readymade bots (heh) that do all this verification stuff, and they are quite popular.
You could also prune inactive members, but again the user account could just say something every now and again, plus any real users who find they have been kicked out for not participating might not be particularly pleased (or might just forget about your server altogether).
My point in the above message mainly focused on bot accounts. It's best to operate at the principle of least privilege. You don't need a music bot to see your staff channels, for example. Keeping with that example, some administrators take the time to limit music bots to a specific music channel. For that, I applaud them. There are simple ways to limit the data bots can get, which mostly rely on common sense on account of the server administrator(s).
Another problem is User bots - ie. clients that look like a regular user but are still doing bot stuff or simply ingesting all messages they see, which is easy since Discord's client implementation between bots and users are almost exactly the same. They could have used some wasm/javascript virtual machine thing that would make it hard to figure out what the Discord client is doing and would make it harder to sign in to Discord via a user bot, but then we'd probably have another set of HN users complain about Discord hiding stuff from users or something.