Someone is probably afraid to be too effective at filtering them out, as it would nuke their numbers. (Engagement/messages sent? Who knows)

If most of the traffic is scams, it’s not like they can remove it without something showing up in their metrics after all.

Search, and USPS ‘spam’ mail has a similar problem.