I don’t think they are a necessary evil; I actually believe they might make fraud easier.
I haven’t had the time to test this properly (making sure to protect my own identity so it doesn’t backfire on me, even though none of this would be actually used to cause damages to anyone), but from my understanding, you could fraud your way through low security companies (telecom, utility, etc), which would report to the CRA and thus build your profile - eventually with a solid enough profile thanks to this you’ll be able to pass KYC checks at online banks with a (fake) passport which the CRA would actually confirm based on previously learnt (fake) data.
To me the CRAs are more trouble than it’s worth - they invade our privacy, they run on a nasty business model where they use our data to recommend often scammy products (especially when you have bad credit), and can be trained to authenticate bad data as described above, making fraud easier.