Fingerprinting would be my guess. It could give at least one extra bit of data about your device (has motion sensors or not).
Could also help detect agent string falsification: why would a device claiming it's UA is legacy IE have motion sensors?
Could also help detect agent string falsification: why would a device claiming it's UA is legacy IE have motion sensors?
Web server to web client: I'm not sure your so-called "user" represents a real-life human user. Can you at least prove that you're a real-life web browser?
Web client to web server: hmm, well okay, here's my User-Agent header. Just curious why you care about who's sending the request?
Web server to web client: Still not convinced, can you give this CAPTCHA to your so-called "user"? As to you second question: bots, spam. And the ad network sponsoring me doesn't trust my tally.
Web client to web server: My human hates CAPTCHAs, and AIs are better at it anyway.
Web server to web client: Ghrmbl. Okay let me talk to Widevine/FairPlay/PlayReady DRM or your microphone/gyroscope/battery level/uptime/...
...
The arms race of surveillance enshittification.
Bots will either all have the same (or a low diversity of) fingerprint, or if not then they will have the same randomisation techniques to mask the fingerprint.
Some of the additional browser features that access devices do reveal the most trivial way to determine "this is not a bot as bots don't have this fingerprint".
Of course that has implications, if privacy makes you look like a bot (it does), then the web has more friction the more private one is.
Now you’re playing botsimulater 2023.