(IANAL) Fraud can often be prosecuted as a civil crime, in which case there needs to be an aggrieved party with credible evidence of damages, no inhibitions about making a splash, and the time and money resources to sue.
I suspect educational institutions don't want to be seen as organizations that sue their own researchers. Same with paper publishers. And same for grant issuers.
Downstream researchers? Do they have the time, the money? ability to show direct damages whose recompense would be worth all the effort?
Students affected perhaps could, but only if the effect was very direct and they had the resources. And desire to be known as someone who sues their professor.
The damage is usually so diffuse. There is no one party with all the reasons to sue.
I have no idea what the process would be for criminal prosecution, but the diffuse impact may be an inhibitory factor there too.