They are probably not actually hosted on AS2. Bad actors can inject garbage into BGP AS paths, either accidentally or deliberately.

Bad actors aren’t blacklisted for repeatedly injecting garbage?

Maybe? Sometimes? It probably depends if what they're doing causes operational issues. BGP is primarily a trust based system. Many upstreams have filters to limit route announcements from their downstream / customer ASes, but at its core, it is trust based.

It’s hardly trust based if enforcement against those who break the trust is so sporadic.

Interesting