The example of cell phone case pictures superimposed over random pictures of food was from an Etsy presentation at a conference I recently attended.
Routinely (i.e. daily) I see activity that may involve 500+ unique IPs and 2000-4000 attempts. The type of activity that I see isn't close to what would be considered an extreme-worst case scenario in the industry.
Assuming the right economic incentives these groups are over time able to duplicate about any behavior that would be seen by a typical customer. For example, they can effectively remote desktop into a device and create a sleeper account and then come back to the exact same device a week later once the probation period has expired and execute a larger attack.
Also it is hard to fully understand that markets where labor isn't scarce fundamentally organize themselves differently. For example one recent attack that I'd see involved multiple attempts from multiple IP addresses and multiple devices all within seconds of each other and using the same credit card for registration. For a while I marveled at the technical skills that would be required to orchestrate such an attack until I realized that it likely was likely a dozen people in a room sharing the same credit card number and launching the attack in a coordinated fashion. Low tech, but extremely effective when labor is cheap.