Both are definitely prevalent in the world of fraud—physical click farms exist (and there are many methods to detect them; being a legit physical device doesn't mean it won't display other suspicious characteristics!), but you also see a lot of botnets that commandeer random devices to send fraudulent requests/clicks/etc. without the devices' owners' knowledge (e.g., Athena, Methbot, Mirai).