To point 3, a friend of mine uses one of his client's addresses (with consent) as his GMB location. I'm assuming anyone who knows property owners would easily be able to convince most of them for a small monthly fee to use their address for this purpose.

That being said, it's very fragile. The above friend was very well reviewed (300+ >4.5 stars) and popular in his market. He told me recently Google suspended him and it destroyed his business for a bit. Not sure if he's back up but he seems to be doing better now.