You're missing the forest for the trees. A regular user account should never have a service principal name (SPN), for the simple reason that it can be attacked in the way described. That is why service accounts have really long complex passwords.

Kerberoasting nearly always occurs due to an installation process that assigns an SPN to an account that is performing an installation, or inappropriately selected by the installer. That is the first problem. The second problem is there isn't anyone auditing this stuff because they are incompetent.

If you reported an issue of an account that had an SPN but should not, nearly everyone would either not know what you are talking about, or disagree that it is a security problem without any knowledge or basis.