bad actors are usually looking for low friction, it’s like running away from a bear… you don’t need to be the fastest person, you just don’t want to be the slowest

You're probably not going to go through the hassle of generating or applying for 1,000 credit cards in order to abuse some trial period on a SaaS service. Maybe you do it a few times.

It's the automated bots that a CC prevents. Even with "free" credit cards or generated numbers, there's a lot of friction in going through that to abuse the service's trial period.