penalized by who? It works enough that tech recruiters and their agencies make a lot of money. If there is no agreement between the company and the recruiter the company is free to contact that applicant themselves. The recruiter will usually hide the contact information of the applicant for this reason.

Enough hiring companies only care about getting a seemingly qualified applicant in for an interview and will ignore what ever shady things recruiters do.