OK, but so what? 'Be on the lookout for XYZ' is an understandable request, but what prevents paypal rapidly distinguishing between credible and suspicious transactions - and more importantly, pre-emptively communicating with users about it, since they are going to find out the hard way?

Conversely, what stops bad actors just switching to doing transactions for t_rdigr_de, ta_dig_ade, or tar_igra_e and thumbing their nose at the filtering? (OK, realistically they would probably switch to some more obscure backup code but you get the idea.)

The basic problem here is that the burden of enforcement is being shifted by Paypal to innocent people with no warning, instead of being shouldered by the company, which is in a position to push back legally on unreasonable requests and plan ahead for reasonable ones.