If I make the bot on web server and allow you to rent it , then the onus of protecting all your private keys and data lies with me. This may become a very risky and costly operation with time.

If it is a desktop application then the onus to protect your desktop from getting hacked lies with you.