Well there are things we can do. For example, if a user creates their npub via an app, then the app has data to check to see if they look like a legit user. If a user registers a nip-05, then the domain that hosts that can do some checking to make sure the person is legit.
I am not sure we can control things without some services that can check / provide road bumps to new users who aren’t legit. The trick is that it’s not centralized in to a single place or service.