Why? It's not like the insecure device doesn't have my identity key on it. If I program it to spam people, I go to jail for spamming.
It would be easier to spoof such identities and some services may not want to deal with the overhead of using the legal system. Spammers today already can be taken to court, but in practice people don't do that.
If only you went to jail for spamming.