If you are a PhD student or a postdoc, you are probably working in a PI's lab and often funded from their grants. It's also common that nobody else at the university understands the project well enough to replace the PI as your supervisor. That creates incentives to avoid reporting abuse and to tolerate unhealthy levels of toxicity, as the likely alternatives are switching to a new lab (and delaying your career) or leaving the academia.

True, there are incentives to avoid reporting abuse. I think in cases where abuse is reported, universities tend to support abusers because they are the ones who bring in grant money. Furthermore, internal control systems are not independent, and they tend to be linked to senior faculty members, who are the ones usually breaching the academic code of conduct.

In many cases journals have retracted articles after evident image manipulation was discovered. University committees rarely take disciplinary action against fraudsters. In some prominent cases they have even issued statements of support. This is starting to change, albeit slowly. For example, Sweden now has a national integrity board that investigates those types of breaches, much more likely to be neutral as it is not closely linked to the investigated subjects.