robots.txt is supposed to keep bots out of cart and checkout. I sent 10 AI shopping assistants to 5 stores. At Gymshark, where /cart and /checkout are disallowed, 6 of 10 walked into checkout anyway. One obeyed the rules at two stores, then ignored them at the third.