In 2017 until now there still a scammer scam other people without conducting any ICO/IEO.

If you want to know how they did it, they will make an AIRDROP for everyone and distributed to all people freely with also creating some HYPE/FOMO for the project. They will be listed the token could be paying from their own pocket/helping vote by doing a reward system for a bounty hunter. When the exchange comes, and the prize rising because a FOMO they will start to dump.

This scheme already used by a few scammer projects, the worst have been seen is "MONEROGOLD" token. They created the token, distributed the token by using an AIRDROP system so without any ICO system, listing their token on the exchange from their own money, making the price FOMO and you want to know the next part? they changed the smart contract code and make the supply unlimited dump it to 0 sat on Coinexchange. The main point is, the project still can scam people by listing their token on the exchange and when they feel the book order has big enough or maybe more than the budget they are spending they could be dump the coins/token and exit scam.

From that's an example, means not conducted ICO/IEO there still has some chance they can do a scam.