So robots.txt is meaningless if they have to violate it to check for malicious content in blocked off pages anyways.
Presumably, the incognito crawlers are only used on sites that have already granted the regular crawler access. That's content that ends up in their index which they want to vet.