@corbet One possibility is that this company places ads on various web sites, with the ads using javascript to make HTTP requests to the websites they are targeting. The people whose computers are using those IP addresses would then not have any idea that this was happening. They may depend on using browsers without the latest security features.
@bzdev @corbet Bright Data runs a "free" VPN service where you offer your own desktop as an exit node for other users and then you can use their network as your exit node, that's the trade and many people willingly make that deal, their other business is selling access to the VPN network for AI scraper bots. So it works like a botnet / Tor but with the willing participation of the nodes, so it is more ethical than a botnet, they aren't wrong.