Theoretically you're right but the most could be caught becasue they do mistakes. They split the amount and move it around for obfuscation. They use mixers, exchange in monero forth and back etc. Successfull scammers have to manage a lot of addresses after a while and then earlier or later they start co-spending some of them. Even if they do it 500 times right one little mistake (co-spending a coin after mixing with coins before mixing) then the house of cards collapse. As said by far the most do earlier or later a mistake and then it's written in stone and cannot be taken out of the blockchain anymore. The reason why the police isn't catching them is because many people don't try it (under the assumption that it's not posssible) and because the police has not enough specialists to follow up.

Btw with mixers. I did recently a check of a Coinjoin Wasabi mixer transaction where people were very carefully and mixed the coins three times in a row. Neverthless I could link more than 20% of the mixers output addresses with the inputs because the users did the mistake to co-spend mixed coins with other coins. 20% might sound not very promising but if  you take into account that a person with 500 transaction can be caught if only one transaction was not carefully enough then it's a number where scammers should start sleeping bad. Even after years all evidences are available in the blockchain and the analytics software (from us btctester or from forensicsone or chainalysis or others) are getting better and better.

The brain of a scammer might think two or three steps but the analytics software use sophisticated heuristics to find all addresses of the scammer and follows all paths of these addresses to see when it goes to an exchange. Mostly there are paths to exchanges because the scammers don't want to go with a hugh amount to an exchange.