Those bad actors are really stupid, a VPN isn’t going to protect them. You’re not magically anonymous behind a VPN, and such material is obviously going to attract the attention of very skilled cyber security experts & law enforcements.
Idiots doing crimes never understand basic OpSec.