If the PlugBot would have two Ethernet ports, working as a completely transparent bridge, shutting down ports and enabling 802.1X won't help much. Bot will just

If the PlugBot would have two Ethernet ports, working as a completely transparent bridge, shutting down ports and enabling 802.1X won't help much. Bot will just patiently wait for target to authenticate, then proceed with IP and MAC spoofing for its operations (filtering on the bridge). 802.1X-2010 and MACsec would address this issue, but they require more expensive hardware and not yet widely supported.