They shouldn't be that difficult to detect, if they're using bots for sign-ups etc.
If the campaigns are actually somewhat decent, they can easily figure out the patterns of these bots and just deny them any payouts automatically.
That said, some campaigns just do not care. They're just in it for a quick money grab and they'll just pay out tokens to these bot farms.
Probably because it's cheaper for them than actually trying to fix it.
Very easy to detect for a bounty manager that is serious. Once signed up for a bounty and while still on the spreadsheets, hundreds of sign up were dropping in minutes. I detected it and called the attention of the bounty manager to it, and he said he's working to handle it.