As someone who gets spam from various Gmail accounts on the daily I'm not inclined to believe it's that difficult.

It's only difficult for those who want to commit the atrocious crime of having privacy.

Lesser evil criminals such as spammers already have a supply chain of phone numbers, residential IP addresses, etc that can be used to work around the restrictions.

I've created several ones over the course of months without any issue. I wasn't even asked for a phone number.

Of course if you do it constantly or from third-world IP addresses, I understand they refuse your attempts.