If they use a Mastodon intermediary, there’s a 30-day cool down. If they use their own, they’d have to expose the IP to do it so it would be discovered. I don’t see how it would benefit them to do that. If they did, that’s some sketchy, bad faith shit and they’d be universally fediblocked pretty quick.
I also don’t think they can monetize non-threads users because they can’t send them ads. It would be difficult to connect you to a Meta account to serve ads to because they only have your user name, profile pic, server IP, and server domain name. In most cases it’d be impossible. You’re pretty well protected because Mastodon servers treat all remote servers as untrustworthy and don’t give them any info.
Lucia