From my understanding a bot is everything that happens somewhat automatically without any further user interaction. So an App that triggers a request to a server is not a bot. But if a server automatically fetches data from another site in order to somehow present it (in an App) to the user (without the user explicitly requesting it), this might more be a bot behavior imho.

But what if a bot (or an app for that matter) uses a library? Or if an app can be ran both manually and automatically (through cron)?

Yeah, it's sometime hard to distinguish between them. In general if we are able to detect and app or bot we should do that, even if they use a detectable library. I would see those library detections more as a fall back if nothing more specific could be detected.