They shouldn't be that difficult to detect, if they're using bots for sign-ups etc.
If the campaigns are actually somewhat decent, they can easily figure out the patterns of these bots and just deny them any payouts automatically.

That said, some campaigns just do not care. They're just in it for a quick money grab and they'll just pay out tokens to these bot farms.
Probably because it's cheaper for them than actually trying to fix it.