The "Privacy" settings are really named incorrectly to start with, They're simply a request, and not one which Bots have to respect (and certainly don't).
As you've noted, without Pretty Permalinks enabled, robots.txt is unable to be processed, There's another ticket to enable them by default, however, for technical reasons, it's not always possible to enable them, thus, they're not enabled by default.
One option would be to disable the Privacy settings when mod_rewrite isn't enabled.
See also: #16416