Then it’s only changed on their instance. They’d need to create fake users and send votes for them. At that point others should be able to detect it as botting, at least if the impact is big enough.