It just needs one case where someone manages to attribute it to the corp using these illicit services.
Either by technical means or by a whistleblower.
Which might be a gamble worth doing, but also might not. And regardless, the fact that it is a gamble alone slows down velocity.
If the content is legally obtainable, couldn’t any employee use their own home network to pull data? I don’t think anyone would bother with a resi. Employees have their own network connections available.