As far as I can tell, "it's impossible to use stolen credentials" is not part of Paypal's security model or a promise that Paypal has actually made. It's important to distinguish flaws in a company's security model from additional security controls we think they ought to add.

But why does that system exist at all, if it's not supposed to do something?

It's not "impossible to use stolen credentials", it's "you have to clear this barrier to use stolen credentials". If that barrier is broken, that sounds like a flaw in the security model.

It's analogous to the systems that make your password show up as dots when you type it in. The security model isn't affected at all - dedicated attackers can "break the barrier" by just looking at your keyboard instead - but it significantly mitigates harm by making certain low-effort attacks harder to perform.

A not-for-sure harm mitigation as part of defense in depth is a great thing to put in a security model.

But with the flaw here, the effectiveness drops to zero. The "making certain attacks harder to perform" is basically gone in the scenario where someone is buying a bunch of credentials. That's not good!