It's chess. You don't have to use this board to check every possible move, as any engine that knows the chess rules can verify if the result is indeed checkmate

It's chess. You don't have to use this board to check every possible move, as any engine that knows the chess rules can verify if the result is indeed checkmate, without using this site's engine. But, basically you're right. If the bot is not using an external chess engine, it could effectively be blocked from brute force attacks the way you describe.