They're doing this because it's impossible to distinguish an authorized client from an unauthorized one based solely on observing client behaviour - the overlap between "modified client, using our services in a way we dislike" and "unmodified client, using our services in a way we're content with" is huge, and if they blocked users for misuse of the cloud service in a way that caused them issues, they'd block a large number of customers using the Bambu Labs build of their official application.

So, they're attempting to say that it's not permissible to take the Bambu Labs AGPLv3 source code, and modify it in a way that doesn't also ensure that the client authorization code is modified, nor is it permissible to take the AGPLv3 client authorization code and integrate it with another project - you must not create derivative works of the AGPLv3 code where Bambu Labs deems it an unacceptable modification.