Github does allow bots (they are even marked as [bot]), but the user must opt-in to them before they can do PRs or other interactions with repositories.
Notice that Apps and Bots are two different things.
Checking that pull-request and comparing the URL of the user with the blue avatar, you notice that the username marked as "bot" is actually an App [1] but the user [2] — linked at the bottom of the right sidebar — is a regular GitHub account (with no "bot" marking). I am not sure how are they different at a technical level, maybe the App is a web-hook and the User is the one interacting with the API. In any case, they are two different things.