And ironically, good security hygiene makes you look like a bad actor. While this "verification" is intrusive and unreasonable - I'm not defending it - often the root is creating an account from a VPN, or with minimal browser fingerprinting allowed, etc. An average user who doesn't take any precautions is likely to have a substantial activity profile already associated to their IP / cookies / etc. But run through a VPN? You trigger all the fraud checks. Use private browsing? Trigger all the fraud checks and hope you like filling out CAPTCHAs constantly on top of that. Tor? Likely to be blocked completely.

Seasoning fake accounts in realistic ways mostly isn't worth the effort, because bad actors can just compromise real accounts and use those instead. (There are some specific use cases, mostly with nation-state actors, where seasoned and aged fake accounts might make sense, but those are unusual.)