Why do people assume these aren't honeypot operations? Millions of compromised windows hosts rented out for $5 each to anybody who shows up at some onion site?

Why do people assume these aren't honeypot operations? Millions of compromised windows hosts rented out for $5 each to anybody who shows up at some onion site? Hard to believe. At those prices buckshot randomware and cryptomining would be profitable. What's easier to believe is that there are millions of SOCKS5 proxies out there (IoT/router/ancient-android-phone exploits) and a honeypot operation that will gladly spin up a Windows VM and let you pick which SOCKS5 proxy to use as an exit IP. And then observe everything the badguy-wannabe does with that VM.