I believe (dang feel free to correct me) some of what you are seeing are bots. They might be OK with only those with showdead seeing the links or to your point might not have bothered to check what sites have blocked them unless they get a status 403.

For example, on my silly hobby sites I provide all bots a status 200 for all GET and POST requests and just send them to a dummy virtual host to let them play in the sandbox for years on end. If they even once looked at the output they would see my silly ASCII art.

Some may be curious about search engines, but since I only allow HTTP/2.0, only bing can even connect with my site and robots.txt tells them to go away.

In NGinx:

    error_page 404 500 501 502 503 504 =200 /ram/e.txt;

e.txt is just ASCII art in a tmpfs ram disk.