As someone who gets spam from various Gmail accounts on the daily I'm not inclined to believe it's that difficult.
Lesser evil criminals such as spammers already have a supply chain of phone numbers, residential IP addresses, etc that can be used to work around the restrictions.