yes, but they cant create 1000s of fake users on EVERY website, unless they wanna shell out millions of dollars per year for the compute power required.