Definitely true. Hopefully the folks who have the skillset to build a large OSS project, and build a network of fake traffic, would find other ways to spend their time with a higher return on investment than a 30% increment of their revenue.
But it will certainly happen, and hopefully we can continue to minimize it. We've generally seen fraud that looks like a site with no real traffic, and trying to generate 1000% returns, which is a much easier pattern to catch.
If you have any suggestions for ways we might improve our fraud tracking, definitely happy to hear them at eric@ our domain.