Oh they have. It's been a big problem for my company. I assume Apple must work on this from their end, but any success would seem to undermine the privacy guarantee of the service.

"Bad guys" using Private Relay is one reason these IPs get blocked: one abuser can cause an entire block of people to get flagged as a single malicious user; and a big enough group of users can also look like a single malicious user to many blocklisting strategies, because they all share the same IP.