Hello @flo and welcome!
@timetocode is right: Because bones are GPU accelerated you cannot pick them with a CPU operation (meaning the deformed geometry is not in the CPU memory but in the GPU memory).
The best way to deal with it is to attach hitboxes to your mesh as you mentioned. This could sound hacky but this is a good viable way to do it 
Here is a good example: https://www.babylonjs-playground.com/#11BH6Z#395