You'll often see certain bot farms running doing specific tasks that the game needs to run the economy, in a sense Jagex uses them to save on labor costs.
The Old School RuneScape economy relies on these gold farmers because most players don’t want to take the time to gather the resources themselves. Most players purchase resources from the games global market, the grand exchange, with the money going to both gold farmers and regular players.
Theres another aspect though, and this is where the gold farmers make their real life money: They sell their in game gold to players who are essentially cheating by trading real life money in exchange for large sums of in game money. These players then use this in game money to more quickly level up skills.
I’m not sure Jagex can clamp down on this cheating without breaking their in game economy.
As a side note, there’s a fairly popular game mode in OSRS called Iron Man where you’re forced to acquire resources purely via the tedious game mechanics instead of purchasing via the grand exchange. It’s a bit masochistic, but I enjoy it personally.
Reasonable profit/hr from botting ≈ 4M/hr/account ≈ $1/hr/account ≈ $16
4M is actually relatively low endgame profit per hour. I haven’t touched the botting scene since 2012, but I run 9 merching accounts on the same box. I have a custom Runelite launcher to manage cache/windows/plugin data, and it’d still be under 20 lines of simple bash to add proxying.
Botters routinely run far more than 16 accounts on the same box by running the game in Android VMs with a lot of graphical rendering disabled. SOTA afaik is to pick up a few wireless hotspots with IPs behind CGNAT, and lock clusters of accounts to common IP pools.
Regarding SOTA: yes it's interesting seeing the mobile-based clients to overtake the scene due to lower detectability/enforcement and resources usage. But when I was in the scene a big question was on client detactability, which nudged some to employ computer vision and screen-scrapping as opposed to fiddling with client code and spoofing official client. I wonder if this question has been settled.