There's also the case that many drug buyers live in jurisdictions where the consequences to them of being found to buy recreational drugs are minimal (Even in this case, the consequences for buyers were some police pointing out "hey, we know"), so they aren't particularly incentivized to cover their tracks or use more secure measures than they would for e.g. facebook, as opposed to child porn which is taken seriously in every jurisdiction. I imagine this leaves the police with fewer entry points.