Circumvention is just 1 point, is it not? Domain names I don't think count? But you could use that as total number of victims (usually they just wing it — the calculation, the feds); PII I didn't see mentioned.
I think SBF is in deep shit and I think the world is better for it. These guys? I don't know, probably not as deep as it looks; certainly not the 10 years that another poster was saying, though.
It's 2 points (pretty much everything is 2 or 4 points). But it doesn't matter, really: the accelerators are nothing compared to the loss table. Again, I think we're saying the same thing! I deliberately tripped as many of the 18 USC 1030 enhancements as I could just to demonstrate to myself that it didn't much matter.
SBF will serve something close to life if convicted because the losses he incurred blow out the guidelines table.
The DDoS'ers will serve something scaled to the amount of losses they actually caused. I think $1MM is a reasonable ballpark, which gets you into the high single digit years.
I think SBF is in deep shit and I think the world is better for it. These guys? I don't know, probably not as deep as it looks; certainly not the 10 years that another poster was saying, though.