1) it's expensive to have AI output millions of emails, assuming it's tailored somehow and not just a template 2) AI is already in place to detect spam, so it's AI vs AI and it's probably more expensive on the attacker side.