What is the end goal of your run of the mill phishing attack?

I see vendors that get phished, the attacker downloads their mailbox and parks it for later. Then they send phishing emails from the account until they get shut down. Round 2 they crack open the downloaded mailbox data, seemingly hunt down primarily recent sent invoices emails and contacts then set those aside. A year or two later they create a typo-domain and start sending out these invoices asking for status updates on already paid invoices, "Oh our banking info has changed, make any payments to X bank routing and account". If they can't find an invoice open to be paid they try to get banking info changed anyways. "Oh my mistake, I see it here - it was applied to another invoice. I'll fix it. We still need to update our banking info for future invoices." Bob's your uncle, they get future monies. I probably find one of these typo-domain and previously compromised user impersonation about once a month from a vendor. Often the account compromised is accounting. Often it's a previously seen phished vendor. I go dragnet and find contact info to report the typo-domain, lay out the issue hard that the previous BEC included CUSTOMER DATA that is now being used to defraud their customers. Sometimes I also report it to the FBI. Lately I haven't had time or energy to send them my findings. I know our accounting@ is frequently sent phishing and unsolicited emails. Fortunately that address is a honey pot! Our real accounting user addresses are also often targeted. They are supposed to be migrating all incoming invoices to shared mailboxes by site name-accounting. If they were real hard on everyone contacting them directly it would help avoid a lot of randos sending in fake linkedin invoices, fake CEO "hey plez pay (fake)vendor I forgot about this invoice and it's L8 late late". It won't fix BEC phishes where the attacker vacs up the entirety of a vendor's mailbox and tries collecting on old invoice data and redirect future payments to a fraudulent bank account.