I did associate / webroot with a real empty folder. So, I don't have any virtual folders.
And as for the Robots/Hacks/Scans, just weekly I review the accesses and use the Ban and the *
You know like 167.248.133.123, that bother from Censys? Well, I just ban 167.248.133.* to minimize the inconvenience.
This plan wasn't instantaneous, but it wasn't laborious.
If anything, upping the ante on the ban ranges has been best for both security and convenience.
In fact, it has been convenient for the miscreants to put their addresses in my logs so that I can increase scope of range blocking on them. . . resulting in a sharp decrease of bother; and, a whopping good bout of better security.
The robots.txt contains suggestions. But, suggestions are only good for real people. However, as for bots, just use force.