I had no idea the .garden TLD even existed. Having just checked Porkbun, it seems like they go for $1.54 which is pretty cheap. No wonder they're being abused.

If you have a cheap TLD of course bad actors will buy a bunch.