I'm blocking empty user agents with this line of code:
RewriteCond %{HTTP_USER_AGENT} ^-?$
RewriteRule .* - [F]
Just imagine a Google site reviewer masks his user agent and gets a nice Forbidden, do you think it might not be wise to use this code just in case a manual review happens?