They shouldn't be that difficult to detect, if they're using bots for sign-ups etc.
If the campaigns are actually somewhat decent, they can easily figure out the patterns of these bots and just deny them any payouts automatically.
That said, some campaigns just do not care. They're just in it for a quick money grab and they'll just pay out tokens to these bot farms.
Probably because it's cheaper for them than actually trying to fix it.
Some bounty manager are very lazy in checking out cheaters in bounty programme and that is the reason why it is very easy for this cheaters to go away with this. most importantly ones they see that a bounty manager doesnt do alot of work in analysing work before allocating token then he will be their target they will be using bot to sign up in every campaign he/she is managing. I have experienced this in the past. despite that i reported that someone my work, the BM still go ahead to allocate token for such stolen work.