Phishing scams are used to obtain the credentials of university accounts which are then used via a proxy on Scihub to obtain the requested article (it's quite clever..they seem to often silently proxy institution's Ezproxy with the phished credentials) . The same credentials given to Scihub are often not just used by Scihub, and are then used for further phishing or hacking by other third parties, causing harm to the phishing victim.
Having said that, library software providers and journal platforms should be looking at Scihub and learning from it. Users want an easy to use platform with minimal fuss or hoops to jump through.
Of course, this is just a tiny piece of the much larger problem of the rotten unsustainable commercial journal publishing ecosystem..