Since ILS-DI (which specifically means the AuthenticatePatron verb) is an option that can be selected for TrackLastPatronActivityTriggers, I would expect the validateUserAndPassword of the REST API to also contribute to updating borrowers.lastseen. Since there is no separate option for activalting it, I thought maybe the REST API is considered so much "core" to Koha that the logins are tracked when "Logging in" is activated as an option for TrackLastPatronActivityTriggers. But it looks like it is not. 

To reproduce in KTD: 

TrackLastPatronActivityTriggers = [Select all]
RESTBasicAuth = Enable

Check the lastseen value of the "koha" user in the database:
select borrowernumber, lastseen from borrowers where borrowernumber = 51;
The value should be NULL, or some past timestamp. 

Run this script: 
https://wiki.koha-community.org/wiki/REST_API:_Checking_username_and_password

Check the lastseen value of the "koha" user again. I would expect it to have been updated when the script ran, but it is not. 

Not sure if validateUserAndPassword should be considered as just another way of "Logging in", or if it should be a separate option for TrackLastPatronActivityTriggers, but the latter would give maximum flexibility.