Because spammers aren't interested in SEO best practice, if they were, they wouldn't be spam posting links in comment sections. The fact the links are nofollowed likely doesn't really matter to them or like you said, they probably don't even know what it means. The people buying these kinds of spam links are probably lied to about their worth etc

Most likely it's bots doing this kind of posting anyway, looking for common comment plugins in Wordpress or whatever and mass commenting this rubbish.