Earlier quoted context omitted.
I believe it actually is illegal, via a set of more general rules on data collection, on what constitutes a fraud, etc. May not be spelled out exactly like this specific use case, but still very likely covered by law. Just difficult to prove.
It certainly would be illegal in Europe under the GDPR - data collected for one purpose (handling of applications) cannot be used for another without explicit, informed consent.
Recently investigative journalists here in Finland found out that a significant percentage of job postings over here are indeed fake. Unsurprisingly, worst offenders were recruitment companies, which sometimes listed fake jobs to generate a pool of applicants they can later offer to their clients. Doing this is easy, as no law requires these companies to disclose who their clients are when creating job postings. It's also very common for same position to get posted multiple times.
Other than wasting applicant's time, this behavior also messes up many statistics, which use job postings to determine how many open positions there are available. Basically the chances of finding a job are even worse for unemployed people than stats would imply.