Yes, there's nothing stopping someone from creating bot accounts on Lemmy and pretty much every other Fediverse platform. Even if APIs are restricted, they can just parse HTML instead (though that's a bigger pain in the ass). This is an area where the decentralized nature of the Fediverse works in our favor, though, as it inherently limits reach and discoverability (thus minimizing the benefits of doing this). For example, Mastodon's flagship instance (mastodon.social) had a spambot problem not too long ago, so what happened is when other instances noticed this spam wave, they limited/defederated with mastodon.social and the problem was solved on their end. The host instance can temporarily close off sign-ups to prevent new accounts from being made. Every other instance can control federation to effectively quarantine the spam problem.