1: When it says 15 requests per 15 minute window, does this really mean I can only send 15 requests per 15 minutes?
2: Do I really need to set up a Twitter bot to send basic requests like getting a list of a user's followers? Is there a way to get the data through a URL, like in most web APIs? I'm making software that will be used by other people, so it can't have a bot auth token in the code.
I know I'm pretty much asking if what it blatantly says is true, but I'm just having trouble believing that the Twitter API is really this bad.
It sounds like you are specifically asking about the friends and followers endpoints. Yes, this is limited to 15 requests in a 15 minute window. Other endpoints / features have different rate limits.

The Twitter API requires authentication. You do not need to set up a "bot", but you will need a registered Twitter developer account, and a Twitter app, in order to use the API. If your app will be used by other people, you would need to implement Sign-in with Twitter to enable them to authenticate with your app; you can then store their access token (until or unless they revoke it) to make requests on their behalf. This is pretty standard for any multi-user web app.
Questions about the Twitter API