It’s not an either-or thing. They are engaging in active moderation as well as limiting botter profits.
This is consistent with how everyone else protects their property. Banks still maintain alarms, even though those do nothing to prevent identity theft. In addition to doing that, they require multi-factor authentication for online access to banking information. They’re not going to abandon one security measure in favor of another.