Maybe it's a lack of imagination on my part, but how do spammers abuse self-hosted runners?
Form submission spam. Unique/'untraceable' IPs...
How do they abuse self hosted runners?
Malware in build scripts/dependencies. That's not exclusively credential/crypto-stealers, there's apparently also a healthy demand for various types of spam straight from corpo gateways...