The end user typically has their device compromised by using free apps where the developers were bribed $$$ to add the proxy "SDK". The botnet operator then rents out the bandwidth at exorbitant rates to anyone who will pay for it.

Chrome extensions are also a huge source of this, they look for extensions with a large install base and then make an offer to buy it to turn all the users into proxies.

end users install shady VPN apps/extensions to watch pirated content, and become part of residential proxy mesh/botnet

Sure, if you want a whole bunch of legitimately malicious traffic to be attributed to your internet account.

Yes. Google “honeygain”

That's probably where some of the proxies come from.

If by “some” traffic you mean botnets, sneaker and ticket scalpers, scammers, content scrapers, credential stuffers … generally scummy stuff, sure.

Based on this blog post I would not do any business with Skyvern, if they indeed do business with this underworld of bottom feeders.