Ignoring conspiracy theories, RMT are generally not a source of income. Most of the time, the credit card information that is used is either stolen or manipulated in some way, which means a LOSS of money for SE if fraudulent claims are made. Likewise, stolen active accounts don't result in more money than what is already being made from the legit owner. It's likely however that the loss does not occur as often as people think and it just results in more of a "meh" situation.
Reporting is unnecessarily tedious in this game, so for that reason alone, it's not worth doing for RMT IMO. I'm not going to waste my time any more than I already had during our naive period with 2.0 launch and reporting the terror that was /shout and /tell spam, hoping to see at least the obvious combat bots banned but never do. Until SE decides to change the way they handle RMT, then realistically, there's no point to it. Report legit players badly behaving if you see it. While they likely won't do anything about bots, they're very adamant about combating harassment and threats between players.
This is actually one of those situations that only have a small part of the whole truth. It's not the usual way accounts are stolen here, it's just one of many. Keylogging can occur from any site. WoW had an instance where users of, I think, MMO-Champion were vulnerable to a hack with an imbedded virus for going to their popular site. The virus itself didn't do much for the users, but could lead to being a backdoor for things like keyloggers and so on. Also, consider hacked Twitter and Facebook accounts. A lot of the time, it's because people clicked or did something they shouldn't have, definitely. Others though, it just happens because of general hack attempts (most of which involved weak passwords).