is bot traffic from an iPhone (or Android device) actually a problem? (or--my theory--is this an outdated hold-over requirement that has been cut-and-pasted into technical requirement documents since 1998?)
Bot traffic to an API server is not usually from your iPhone or Android device, instead they come from bot farms, that nowadays(August 2020) are a collection of compromised servers and iot devices working together or individually to attack/crawl/scrape an API server.
I don't discard that mobile devices can also be compromised to act as bots, but that isn't usually the case. Unauthorized traffic that is reaching the API server from a real mobile device it's generally from a cloned/tampered version of the official mobile app available in the iOS and Android stores.
You also have the situation where an attacker may be performing a MitM(Man in the Middle) attack against the original mobile app installed in a device he controls in order to manipulate the traffic in both directions. An example of a good open source tool for doing a MitM attack is mitmproxy:
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
This tool can be used to exfiltrate data or to gain access to privileged features/data that the mobile app doesn't expose, but the API exposes. Another form of achieving the same is to use an instrumentation framework to hook at runtime on the original mobile app. An example of such a framework is Frida:
Inject your own scripts into black box processes. Hook any function, spy on crypto APIs or trace private application code, no source code needed. Edit, hit save, and instantly see the results. All without compilation steps or program restarts.
Bad bots traffic is indeed a very serious issue for API servers, and they are very hard to mitigate, because while it's easy to identify/authenticate who is in the request, it's very hard to do the same for what is doing the request.
Wait, I don't get it, but as you a lot of others are not aware that this difference exists or have a misconception about it. Until 2018 I was one of that developers, therefore I would like to first clear this common lack of knowledge or misconception about the difference between who and what is accessing an API server.
The Difference Between WHO and WHAT is Accessing the API Server
I wrote a series of articles around API and Mobile security, and in the article Why Does Your Mobile App Need An Api Key? you can read in detail the difference between who and what is accessing your API server, but I will extract here the main takes from it:
The what is the thing making the request to the API server. Is it really a genuine instance of your mobile app, or is it a bot, an automated script or an attacker manually poking around your API server with a tool like Postman?
The who is the user of the mobile app that we can authenticate, authorize and identify in several ways, like using OpenID Connect or OAUTH2 flows.
So think about the who as the user your API server will be able to Authenticate and Authorize access to the data, and think about the what as the software making that request in behalf of the user.
Possible Better Alternative
If so, are there better alternatives that are mobile-centric over yet-another-annoying-CAPTCHA?
You can use the Mobile App Attestation concept in conjunction with the Android SafetyNET and the iOS Device check in order to achieve a very high degree of confidence that you truly have locked down your API server to your genuine mobile app. Please read my answer to the question Restrict API requests to only my own mobile app for more details.
Do you Want to go the Extra Mile?
In any response to a security question I always like to reference the excellent work from the OWASP foundation.
OWASP API Security Top 10
The OWASP API Security Project seeks to provide value to software developers and security assessors by underscoring the potential risks in insecure APIs, and illustrating how these risks may be mitigated. In order to facilitate this goal, the OWASP API Security Project will create and maintain a Top 10 API Security Risks document, as well as a documentation portal for best practices when creating or assessing APIs.
For Mobile Apps
OWASP Mobile Security Project - Top 10 risks
The OWASP Mobile Security Project is a centralized resource intended to give developers and security teams the resources they need to build and maintain secure mobile applications. Through the project, our goal is to classify mobile security risks and provide developmental controls to reduce their impact or likelihood of exploitation.
OWASP - Mobile Security Testing Guide:
The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security development, testing and reverse engineering.