Google on occasions has been known to ignore robots.txt, it should never be treated as a guarantee. Sensitive pages should always some of form of authentication, or you could opt to block those user agents by returning a 403 forbidden status.
However, this is not the issue.
Googlebot is known to probe sites with different user agents, it does this to ensure there's no abuse and to understand what your site supports, and what it doesn't support.
If you see Android, iOS or anything in the user agent it doesn't mean that the Google's mobile-bot is crawling your site... in fact if you take a closer look at your access log entry your see that it does not mention the Mobile Bot, which it will when indexing your site in Google Mobile Results... Google lists there user agent strings on there website.
- Normal Bot:
(compatible; Googlebot/2.1; +http://www.google.com/bot.html)
- Mobile Bot:
(compatible; Googlebot-Mobile/2.1; +http://www.google.com/bot.html)
Pads are not Mobiles
It should also be noted that Google does not treat Windows, iOS and Android pads as mobile devices. It's likely that your site is being probed by Google, but more likely that Google treats it's own Google Nexus X5 as both a Pad and a Mobile, due to the high resolution offered by this device (1920x1080) in landscape mode, comparable to a desktop
Tablets: We consider tablets as devices in their own class, so when we
speak of mobile devices, we generally do not include tablets in the
definition. Tablets tend to have larger screens, which means that,
unless you offer tablet-optimized content, you can assume that users
expect to see your site as it would look on a desktop browser rather
than on a smartphone browser.
It was announced by Google that they would be changing there smartphone user agent awhile back:
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile
Safari/537.36 (compatible; Googlebot/2.1;
+http://www.google.com/bot.html) (Googlebot smartphone user-agent starting from April 18, 2016)
So, maybe the website that I linked about user agents is outdated, but going back to what I said about probing, Google does this... to better understand pages that use newer web technologies. Also, Google may treat some mobiles as Pads depending on viewpoint resolution... unable to confirm this but would make sense... since they are capable of displaying the same content as a desktop PC.