A malicious developer might reveal details about themselves during the transaction process despite using bogus credentials. They might reuse those credentials for other things, or provide other revealing details in what they upload. So at the very least the adversary is revealing how they would obfuscate their identity, which can be connected to past or future criminal activity.

Maybe not, but there a card that was used to pay the fees, IP address logs for the uploads, whatever forged documents used for identity verification, the fake DUNS number if it was a company, bank account details if there were paid apps, etc. There’s also the hardware identifiers of any Apple hardware associated with that account, which would have been necessary for testing. There’s lots of things to subpoena.

Much better than nothing.

They have to have some validity to pay the $99/y developer fee

Yeah, the ability to pay $99/year. Not much else.