The private key in question, (not encrypted with bip38) is already owned by the malicious operator.
He is the owner of the private key without a password.
....
But he could at any time transfer the funds and make the treasure hunt ... a rip off.

It is more a sort of trap to waste computing power / time
....