Third-party clients will often fail to act like the first-party one, causing them to be detected as userbots and banned automatically, among many other things. Modding the official client is usually looked past, as long as it doesn't touch the websocket/REST APIs in any way, but custom clients are verboten.

Obligatory "I don't work at Discord, just actively develop against their API" goes here.

I'm pretty sure the official client doesn't have the scriptability needed to be useful for perpetrating spam attacks. So the point being made was that banning 3rd party clients is one of the most effective ways to prevent spam, but at the cost of also banning benign use too.

"Raids" or spam attacks use 3rd party clients/headless libraries that fingerprint identically as this repo, unfortunately.

There are also a number of cases where a few third party clients that let you modify the background, font, etc. came with malicious code to steal tokens.

This is probably true. The amount of fishing scams I've seen on discord lead me to believe that is by far the main way it is done, and the scale is more than sufficient for the attacks we're seeing.

malicious 3rd party apps can probably steal the login creds pretty easily to launch whatever type of spam attack

then there is less incentive to install one. Which will lead to less possible targets. I think they compared the risk of compromised third party clients to the usability.