you need to research about JA3, JA4, bot score, attack score and bot detection ID
there is lot more than user-agent... i actually only use user-agent to whitelist some requests from certain ASN, most of the time, they are just totally ignored.
bot score on the other hand...bot score == 1 is 100% certain that is a bot... and many have chrome or firefox user-agent
JA3 and JA4 are standards, go read wikipedia
Bot score used machine learning and static rules to give a score to a request. score 1 is a bot, score 100 is a human. Usually the graph is a U, with bots and human detected.
attack score is based on the request itself and payload
Some exampled of bot IDs arriving to one of my sites, so you can better understand what may be detected... of course, this is a cat and mouse battle, detection improves, attackers/bots finetune things, creating new patterns that need to be mapped and added, repeat.
33554530 (Scraping bot - TLS Signature )
118152435 (Google Images - Verified bot)
120623194 (GoogleBot - Verified bot)
33563990 (Unclassified bot - TLS Signature )
33554530 (Scraping bot - TLS Signature )
33563831 (Python - TLS Signature )
33563859 (AI Bot - User-agent (ClaudeBot))
33563986 (AI Bot - User-agent (OAI-SearchBot))
126255384 (OAI-SearchBot - Verified bot)
so no, user-agent is just a VERY small part of this