Yeah, but they are still real accounts that exist. AFAIK, whether they're operated by humans or machines isn't a consideration when reporting user numbers.

But your comment almost says it: Whether or not they're actual users isn't a consideration when reporting user numbers.

Are they reporting user numbers or account #s? Is it ok if they generate 1billion accoints themselves? Why/why not? What's different?

Impressions are based on "eyeballs" on ads. Machines look at ads. Customers can project ad blocker %.

Intent to defraud would be clear if they generated a billion new, fake accounts.

Why is it not clear if they report metrics that suggest they have more users and higher engagement than they do?

The purpose of buying ad space is to expose your product to people as an impression or as an action. If I tell you I can sell you a service that will show your ads to 10 people and you agree to give me money for that statement, but 5 of those people are running 2 accounts each, that's misleading and, dare I say, fraudulent.

You're wading into "plausible deniability" territory.

Bot use endpoints that don't return ads so I don't see how they could cause fraud.