I think sites like quantcast, compete, google analytics etc tend to not include bot traffic b/c bots often don't evaluate javascript, and those tracking services often use toolbars/ajax requests that bots don't have.
So, pointing to pageview graphs that track ajax requests / toolbars and assuming that it's mostly bots is likely to be a false assumption b/c bots are likely not included in those pageview sums.
The "Like" and "Follow" buttons on Tumblr require JavaScript, probably to make CSRF harder. A bot that automatically likes posts would need to evaluate JS.
Liking a post on tumblr is just a POST request; it doesn't require Javascript. You can scrape the page (for the content id and authentication key) and submit the POST request to like the content without ever running Javascript.
So, pointing to pageview graphs that track ajax requests / toolbars and assuming that it's mostly bots is likely to be a false assumption b/c bots are likely not included in those pageview sums.