can't I just run some kind of bots, that randomly generate addresses to see if they have funds in them?
See
this question on the StackExchange site for a rundown of why brute-forcing private keys (which is essentially what you're describing) is also a no-go.