Most likely it's bots doing this kind of posting anyway, looking for common comment plugins in Wordpress or whatever and mass commenting this rubbish.
1) Some spam services (think Fiverr backlinks or other low-quality marketing like that) get paid for getting links to appear on a page: it doesn't matter if it's nofollow or a low-quality, obvious spam link. They just want to meet their quota and get paid. They're essentially taking advantage of desperate businesses who want to build up their links.
2) Even obvious spam links get some clicks, if only out of people clicking by accident or out of curiosity or boredom. If you have some dumb process that can get you 1,000 nofollow blog comments scattered around the web a month, and each of those links gets just 1 real click a month, that's not a bad outcome if it's a repeatable, semi-scalable process.
3) Nobody except Google knows exactly how their algorithm works, but is there actually any proof that nofollow links don't have some benefit to sites for search engine appearance? Perhaps even chance of a marginal sliver of a benefit for spamming out links is considered better than nothing.
That is, search engines put it there to make people feel like they can do something about spam, but it is up to the search engine if they really honor nofollow or not. Web site operators are so afraid of losing pagerank that many of them stopped linking to other web sites long ago or tagged everything "nofollow" so there might be more ham than spam marked "nofollow".
(There was that time I went to a conference and an exec from Bing was there and I told him if Matt Cutts, his counterpart from Google, was there I would have ordered a cream pie from room service since Google is notorious for gaslighting and giving false info to webmasters)
Note people can click on a nonfollow link and get you to go their web site also and I'd say that is real measurable traffic, whatever effect PageRank may or may not have on their rankings is not measurable.