A malicious developer might reveal details about themselves during the transaction process despite using bogus credentials. They might reuse those credentials for other things, or provide other revealing details in what they upload. So at the very least the adversary is revealing how they would obfuscate their identity, which can be connected to past or future criminal activity.