There's an enormous and growing market of fake GBPs for the purpose of selling leads called Local SEO Lead Gen. (each entity can bring in thousands of dollars/month.)
The thinking is why go through the headache of dealing with clients who can fire you the day after they begin ranking (Local SEO is heavily "front loaded" work wise), will always try undercutting you on price, etc, when you can CREATE YOUR OWN entity, get that ranked and then SELL the leads to that plumber. You're the one with 100% control and if the plumber isn't happy, there's a dozen others who'll gladly take those leads.
Advanced lead gen owners use software such as MultiLogin along with mobile proxy farms to have hundreds of separate Chrome "entities" saved, all using different proxies, their own cookies, etc. This along with an infinite amount of other tools for call tracking, CTR manipulation, etc.
Mobile proxies have really changed the game, giving these lead gen folks an advantage. Because of the nature of mobile proxies (where multiple people can "share an IP address"), it's more difficult to detect. Since EACH GBP entity can bring in thousands/month, it's miniscule in terms of cost.
Reviews? Laughably easy to purchase and outsource, starting around $5/review. Combine this with fake Dalle images to attach to the review and/or GBP itself, and things can only get worse from here.
Google has actually begun VIDEO verification where you literally have to facetime with a Google employee to verify you own the business you say you own... even this can be gamed since any type of manual verification will be outsourced.
Oh and the real masters of this business model? Well they don't bother SELLING the leads to contractors, they will quite literally start their own company and will hire their own plumbers, electricians, concrete crews, etc to squeeze as much profit as possible.