the bot will record any of the balance changes and it will then instantly send the ether out to the thief address.
Who is the thief here by the way, if you ask me it is the person who is trying to import someone else's wallet with their recovery phrase, thus i wouldn't mind if they are in the receiving end in their attempt to steal. If you try to steal from someone else and get robbed in the process, it is fair enough to say you can have no complaints right.