Well that means that nofollow is no longer effective enough to completely shut out link building by spammers. However, there's two new attributes I've read about which can help in this case:

rel="sponsored": To be used for advertisements and has no effect on Google page rankings

rel="ugc": For all user-generated content (e.g. forums), also prevents the links from being used in page rankings.

(You can check https://www.searchenginewatch.com/2020/07/24/what-google-says-about-nofollow-sponsored-and-ugc-links-in-2020-does-it-affect-your-seo-rankings/ for a more detailed explanation.)

So in this case, I believe that Theymos should change the attribute to rel="ugc" to solve this problem.