They shouldn't be that difficult to detect, if they're using bots for sign-ups etc.
If the campaigns are actually somewhat decent, they can easily figure out the patterns of these bots and just deny them any payouts automatically.
That said, some campaigns just do not care. They're just in it for a quick money grab and they'll just pay out tokens to these bot farms.
Probably because it's cheaper for them than actually trying to fix it.
Thats very true!! Scam projects dont care. However, there are also some honest projects who go into an ICO thinking they can manage the bounty themselves based on their corporate marketing experience; NOT KNOWING that bounties in cryptos is a different animal. They arent prepared or experienced to deal with scam bot making developers who have been in cryptos much longer.