[unimpressive]

>The actors I've seen taking advantage of it are highly unlikely to front up with a credit card and provide what amounts to personally identifiable data (i.e. make a credit card payment) in order to mass enumerate the API.

Unless they just steal a credit card. Not unlikely, given who we're talking about here.

[novaleaf]

Yes, but burning a "good" stolen card to buy a $3.50 subscription is a waste.

Using an "exhausted" stolen card would get flagged by a good payment provider (Stripe!)

The only issue is in some parts of this world credit cards are difficult to obtain.