Most likely it's bots doing this kind of posting anyway, looking for common comment plugins in Wordpress or whatever and mass commenting this rubbish.
1) Some spam services (think Fiverr backlinks or other low-quality marketing like that) get paid for getting links to appear on a page: it doesn't matter if it's nofollow or a low-quality, obvious spam link. They just want to meet their quota and get paid. They're essentially taking advantage of desperate businesses who want to build up their links.
2) Even obvious spam links get some clicks, if only out of people clicking by accident or out of curiosity or boredom. If you have some dumb process that can get you 1,000 nofollow blog comments scattered around the web a month, and each of those links gets just 1 real click a month, that's not a bad outcome if it's a repeatable, semi-scalable process.
3) Nobody except Google knows exactly how their algorithm works, but is there actually any proof that nofollow links don't have some benefit to sites for search engine appearance? Perhaps even chance of a marginal sliver of a benefit for spamming out links is considered better than nothing.
That is, search engines put it there to make people feel like they can do something about spam, but it is up to the search engine if they really honor nofollow or not. Web site operators are so afraid of losing pagerank that many of them stopped linking to other web sites long ago or tagged everything "nofollow" so there might be more ham than spam marked "nofollow".
(There was that time I went to a conference and an exec from Bing was there and I told him if Matt Cutts, his counterpart from Google, was there I would have ordered a cream pie from room service since Google is notorious for gaslighting and giving false info to webmasters)
Note people can click on a nonfollow link and get you to go their web site also and I'd say that is real measurable traffic, whatever effect PageRank may or may not have on their rankings is not measurable.
Links to other sites are a key signal for Google that a site is worth showing. If all links are equal - that is, without any directives like nofollow or ugc - then it's much harder for Google to do this properly due to the existance of comment sections, user posts etc.
So observing nofollow directives on links is in Google's best interest since it's a direct signal from the site that "I don't fully trust this link, so don't think my linking to it is an endorsement". It helps search engines understand what links that particular site is linking to out of endorsment, and what links are there for other reasons such as comments etc.
I've run tests where every internal link to one specific page on a site is nofollowed. The result is that every page ends up indexed except the nofollowed page.
Site owners nofollowing every external link is just a lack of knowledge stemming from a time when it was "best practice" to keep all of your "link juice" internal, which I think you're hinting at with your mention of pagerank which is an equally outdated concept.
Agreed that spammers probably do it regardless of nofollows because one or two people might click the links though.