So I asked 3CX Support about this behavior, and at least in my case the explanation was very good and gave me a clearer understanding of why this happens. There are two responses I will post here with permission from 3CX Support, the first for my original question about this subject, and the second a clarification of what happens if I "reject".
This from Nick, a Senior Support Engineer:
Original Reply
This could happen, but let me explain in a bit more detail. Like most supported deskphones do when you plug them into the same network where 3CX Phone System is installed, when you install a 3CXPhone app it will show up in the Management Console under "Phones" as the deskphones. Now if you send a Welcome Email to provision one of the 3CXPhone applications, once a user double-clicks the provisioning file, the settings will be loaded into the 3CXPhone app but it will first go into CTI mode. At this point this endpoint will still remain as bold in the "Phones" node until you switch the 3CXPhone into softphone mode (not CTI).
Another scenario in which this could happen is if you install 3CXPhone on a PC on the network which will cause it to show up in the Management Console, but then before using a provisioning file, the PC changes IPs, then you provision the 3CXPhone, this will cause the bold entry to stay there as it appeared when the PC had the initial IP.
Regardless however, if every endpoint is working as intended, if you want you can purge the bold entries without affecting the functionality of the Phone System in any way. To do this all you have to do is go to the "Phones" node, select all the bold entries (you can use the Shift key to select multiple entries) and then press the "Reject" button.
Follow-Up
If the reject anything in the "Phones" node, it will always come back if you launch the 3CXPhone app again and it does not have an account on launch. The same applies for deskphones, if you reject them, but them restart them, if they do not have an account registered in them they will reappear in the list, as long as they are on the same network as the 3CX Phone System server of course.
When it comes to 3CXPhone apps however, even if they are not in the list as bold, you can always send a Welcome Email regardless and provision them that way.
Hope this helps someone. It did me.