> If I wanted to use this for malicious intent, then I think the most valuable thing I could get away with would be a 5% discount coupon

Or spinning up hundreds of accounts on a website so you can perform card testing. Or creating accounts so you can put all of the inventory for an e-commerce site into carts to reserve it for yourself. Or running sneakerbots. Or any other malicious intent where the victim is the website operator.

Again, wouldn't it be easier for the attacker to just buy a domain and use that completely undetected instead of having to use a rate-limited disposable email service?

You're assuming they're doing it hundreds of times a minute. Often they're signing up for the accounts by hand to get through the captchas. The rest of it can be automated

That's what I would assume most of them are doing, yes.

In this day and age I don't understand why they wouldn't be able to just use a headless browser instead of doing it manually - has labor really become this cheap?

Captcha and rate limiting solutions are extremely good at stopping completely automated signups. It's far easier to pay someone in India a few bucks to sign up for a hundred accounts so you can do card testing than it is to run a server and write software for it. Hell, most of these people probably aren't even programmers.

I think that's for the small players though as this should be pretty slow, expensive and have the risk of the "employees" stealing the data (the business they are in is practically stealing so I don't think they have high morals).