I don't doubt that stolen cards are involved, but you could say that for anything that has to do with card-not-present transactions, e.g. Amazon retail. Is there reason to believe that it's especially prominent in this case?

I assume most of it is just people who want cheaper access to these models and don't mind subsidizing access via somebody who is simultaneously distilling the model.