I wonder what the PGP signing concept does to thwart people who want to profit and don't care about the public good. It seems like anyone who attends a signing party can sell their key to the highest bidder, leading to bots and spammers all over again.

You can never prevent things like this, but you can make it expensive enough to effectively solve the problem for almost all use cases.