Most users of residential proxies just get a SOCKS5 address and routing, they don't actually get computational resources of the infected systems beyond that. The user of the proxies, the operator of what the article describes as a control node, would be the device responsible for the PoW.
Do you have any evidence that AI providers aren't using residential proxies?
Yes, the status quo right now is merely bandwidth... but if there was money to be made in providing a small amount of compute for the sake of solving the next gen captcha's, you can bet offerings will expand to meet it.
It's impossible to prove a negative. They could all be running secondary scrapers using malware proxies... but what we do have is plenty of evidence of them using fixed IP pools with appropriate user agents. I don't see any Chinese user agents... so two guesses who may be driving the bulk of these AI scraper requests via residential proxies.
Do you have any evidence that AI providers aren't using residential proxies?