Besides proxying to try to mask their activities, wouldn’t those playing host to bad actors have to have some insight or notice some abnormal activity that might give away that someone may be abusing their services?
Or is it that there’s a mix of a financial & legal advantage to remaining as ignorant to that activity as possible for as long as possible up till push comes to shove & they’re being served a warrant?
It’s the latter. As long as the bad actor gives money to the hosting company they don’t really care (and for legal reasons they either can’t or won’t monitor things too tightly) what you do with the capacity you paid for. And when it becomes annoying enough they’ll suspend the account. Rinse and repeat.