They test the cards so that they can sell the card list and promote such a sale with assertions about how much of it is good (100% tested, etc).

These brokers don't want to get involved in any significant fraudulent charges for various reasons.

Once you have a stolen card though, what large purchases could you realistically get away with that won't leave an audit trail right back to you?

Lots of ways to monetize a working stolen card, although as GP says, the people stealing the credit card information are generally selling those cards to other people who'll actually try to turn them into cash. Gift cards and any sort of virtual currency are always big and easy. Buying advertising for affiliate marketing works. If you're willing to take on more risk, ordering actual physical goods to be delivered to empty houses and picking them up there - back in the day, we caught a guy who was ordering a bunch of iPods online, having them delivered to a bunch of houses in a development that wasn't finished yet, and then just following the UPS truck around when they got delivered and picking them up off the front doorsteps.

Given that gift cards and virtual currencies are obvious and common approaches, could banks or payment processors not somehow put up big restrictions on cards being used for sudden large purchases on products like this?

At the end of the day, there's a lot more legitimate transactions than fraudulent ones. It's very difficult to restrict a particular type of purchase en masse without having a huge false positive rate. That's exactly why companies like Stripe work so hard on developing signals to feed into their fraud models.

Gift cards are one of the biggest avenues