having actual physical phones seems unnecessary for that.

With the incorporation of e-sim, maybe? But my assumption is, if they are bots, they’ll be need every possible way to seem like an authentic smartphone user from having different installed apps, advertising id, imei, browser fingerprint, app fingerprint, and one of the important variables is using cellular or residential IP addresses. That needs sim cards on each device. Then they’re just automated from a computer.

You can probably fake some of these on a vm, but bigtech has tools to discern bots from users with a lot of tools and exploits. They also sometimes just allow it to seem there’s more engagement and to prop up their user base.