It’s just money, same as advertising. 1 in X impressions results in a click, action or something.

If it is, in aggregate, basically free to splash your message all over the internet and generate X impressions, then you’ve got a click/action/whatever.

So now you monetise that click: you sell the clicks to a third party who attempts to compromise the users with some packaged n-day exploit system, or buy one yourself, or do something else malicious. Or if they are really stupid just try and sell them crypto.

Once they have “converted”, bundle the data up (CCs, creds, data, whatever) and sell that on. Rinse and repeat.