I know this isn't said in total seriousness, but just in case people are curious, the bots we usually get won't bother with PMs. They're SEO bots and thus need to post in public. PMs get them nothing as their clients are paying them to build "organic links", not actually hawk their products. This, by the way, is why they're perfectly okay with posting total gibberish as long as their URLs and a couple keywords get in there, and why my (unpopular) suggestion for dealing with the spambot issue is to simply not allow new users to post URLs until they've made a handful of other posts first (it's unpopular because it precludes new users from making bug reports; I haven't dug through the modules for how XenForo handles it but on my vBulletin forums this is something I can handle granularly on a per-forum basis so I can make especial exceptions like that).
The ones that would actually futz around in PM -- actual advertising bots -- aren't all that common anymore (their era was 10 years ago, give or take), particularly on forums with niche demographics and smaller user bases (which, in the grand scheme of things, this one is). That said, one of the default checkbox functions on our Spam Cleaner button is to delete any and all PMs they have sent, so if we were to get a wave of adbots and people use the in-Conversation Report function we can deal with those without needing to involve direct admin intervention (Reports from a Conversation include the specific single post that is reported, so we can see that much to verify before culling).
And, speaking of spambots, since I'm going to sleep now (it's 1:30am in my part of the world) the rest of the ones for tonight are up to other folks with access to the Spam button to nuke. =)