I've seen UTF-8 with a BOM while consuming data when integrating with strongly Windows-centric environments. Relatively uncommon, but does happen. And it is very annoying!
Which is why all my robots.txt files have a comment on the first line.
That doesn't stop a BOM being generated or consumed.