There is no "list of bad bots" since that so-called list would be different for each website. What may be "bad" for you might be "good" for me.
I would recommend never taking anyone's advice on what to block or allow. Do the research and make that decision yourself.
There is no quick fix to website security. You need to do the leg work yourself. Blocking without full understanding of what you're blocking could have a significant negative affect on your website.
Note: If you publish ads, it may be to your benefit to allow bots that offer products about marketing data or advertising. These products might be used by advertisers who bid for spots on your pages. If you block those bots, the advertisers may never know those ad spots are available.
