Does anyone know WHY these bot orders are being created? What does it accomplish? Does creating a fake $0 order help them gain information to do something else malicious? Do we need to protect our accounts/shops in some way? Thanks.

Recommend flagging this to help identify it as fraud: when on the page for that order, hit the "More actions" button at the top right, then select "Cancel order" then select the option "Fraudulent order" - you can UNcheck the "send a notification to ...

Those are set up using the new "Collapsible tab" block option on the "Products" customization page. You also have to set up metafields, then update each listing to put the content you want within each collapsible tab into a metafield that you assign ...