Some software packages that allow you to manage iOS devices on Windows/Mac without iTunes, make backups and the like, have this function to let them use your Apple ID credentials to download single IPAs without using the App Store.

I put a test ID never used outside, and months later, I see a login attempt from Jamaica (from Apple's privacy takeout export, the media services log). Since I tested several of those apps on the machine, I won't give names because I have no way to prove which one was.

The makers of these tools, are usually eastern european or chinese, but they are incorporated somewhere else.