[derefr]

> I don't see why they couldn't do some kind of compromise like an account has to be of certain age/spend to use port forwarding.

In my personal experience investigating these scammers: people are happy to resell "used accounts of good age and reputation that they no longer need" on blackhat marketplaces — usually for about a dollar.

Here's one such marketplace: https://lzt.market/

(Hopefully linking to it like this will increase the probability of the right eyes seeing it and getting it taken down)