There are many best practices (such as using multifactor authentication) used by both legit and sketchy organizations.
We're talking about a practice that is intended to avoid abuse detection. In the case of the non-sketchy parties, they're hoping to avoid false positives, but they're still doing the same thing. I'm not criticizing, I'm pointing out irony. When legitimate users have to do the same things as sketchy users, your abuse detection sucks.
Great point and I fully agree.