I too played a bit with the API today and it is very easy to do everything that a user can do as a Lemmy Bot. So please take this into account when securing your Lemmy instance.
We can also use this power to protect our users. For example a bot could send a welcome message with a link to the instance rules, the first time a user comments or posts on the instance.