> I don't see how a company can afford all that hardware and power to do something that is illegal to begin with.

An evildoer would use stolen credentials, stolen credit cards, or stolen hardware (botnets).