What sort of answer are you looking for? All of these proprietors are human. Humans make mistakes and act irrationally at times. Criminal enterprises are complex. Opportunity for mistakes increases with scale. The guy who ran Doxbin is the only high-profile case I can think of with apparent-flawless opsec, and that much only because he bailed before the long tail caught up to him.

The tightest opsec I've ever seen is maintained by disability fraudsters. Privacy laws protect the evidence anybody would need to present against you, so as long as you keep doctor-hopping and never admit to anything, nobody can touch you. These people tend to be reclusive and not public-facing, but with such low risk comes low reward-- there's no real money to be made in it.

(...unless you're the doctor knowingly signing off on false diagnoses. This increases scale, at which point, the more of those you write, the greater the chances of some mistake made by you or any single one of your patients bringing the whole enterprise down.)

The original Silk Road supposedly had amazing opsec but they caught him because one time he used the same, oblique username to register something many years previous IIRC.

It sounds pretty easy to inadvertently visit a site on an old laptop with javascript enabled. Is this what counts as a profound opsec failure these days?

Remembering that you only have to make an error like that once.

And if all these high-profile people manage to get caught (It seems like pretty much everyone that isn't a nation state ends up getting found eventually!) then maybe it's not that these people are terrible at Opsec, it's maybe that it's much harder than it looks, especially when the government has access to tools that you have no idea about, and maybe it's inevitable that you make an error if you are a human operating for a long time, regardless of 'opsec' skillz.

Okay, how about that darknet market where their frontend got seized by the Feds with the big "website seized" plaster, and then the market operator seized it back, that was hilarious

the server was never seized and the operator was never sei

what about the currently existing markets still up? just one trip to dark.fail to check

Maybe the dark web makes people feel safe and they let their guard down? I cannot imagine why else someone would use their own email address in any transaction or operation.