As far as I know, they just spoof the originating number. This makes reporting the numbers useless, as well as any kind of blacklisting. Imagine if you could send spam emails from any arbitrary IP address or domain you wanted to. Blacklisting would be meaningless in that case.

The spoofing happens frequently and it's incredibly frustrating if you are the unfortunate person whose number gets spoofed.

My number got spoofed by a robo-dialer who called the ENTIRE +1 469 prefix. I received dozens of calls a day from angry people who got called.

I’m afraid my number might be used as the originator someday. Often when I get these calls, I keep them on the line as long as possible, feigning interest in whatever they’re selling. I figure as long as I tie them up, maybe I can waste a bit of their resources. Probably futile, but makes me feel better.

Except they might retaliate one day and set their outgoing ANI to my number...

I do the same. A few of them got very angry, yelling quite creative obscenities. Some were amusing and I had never heard of. I took it as a an enriching cultural exchange. But did realize they have my number and could do something like what you suggested.

It's a fun hobby to learn to swear in all kinds of languages. Russians are very creative in this respect.