Bot detection is based solely on the user agent and whether it matches one of a known set of bots (which isn't that exhaustive, only covering common ones).
But beyond that, our online list is based on any page loads in the last X minutes (defaults to 15). GA is likely closer to real time as it uses JS and can know whether the page is still open and whether a user is interacting with it.