While Warframe is a perfect example of a well done FTP model, you can buy a lot of stuff with real money in Warframe, it isn’t just cosmetics. But it has limited PVP and the community is fairly friendly, so it isn’t so much Pay-To-Win as it is Pay-To-Not-Work-Hard.
If you feel like you’ll need more RAM or a bigger SSD then that’s a simple thing to do but this will give you all of the components you need for a solid system at whatever your price point is.
That said, the “Great” range and up will play pretty much anything. You can even play pretty much any game on the “Good” range and up. So if you are looking to save money, I’d say the “Great” range will last you a good 5 years right now at least.
Even the PS3 game can be played via an emulator. The tech is still evolving so you still need a fairly powerful computer but it is playable. For reference, I was able to test archiving various PS3 games on my now 11 year old gaming PC which was a medium-tier system at the time of the build.
While what you say is absolutely correct, keep in mind that the profits a game makes go to the company. The workers are already paid. If a game doesn’t make money it would likely mean those people at the bottom would lose their jobs but the people at the top will absolutely get their share. But stealing a game like this doesn’t mean people aren’t getting paid. If Bethesda feels like the game doesn’t need all of the staff it took to make it, they’ll still get rid of them, regardless of how popular the game may be doing at any given time.
Indie game studios stand a better chance at doing right by their employees but a capitalist society means the profits go to the top and the losses go to the bottom and rarely are indie studios exempt from this rule of economics.
This person is being punished because they found a weakness in Bethesda’s setup and exploited it. It MIGHT be that if they had gone to Bethesda and let them know of this vulnerability rather than trying to sell what they had found that they would be been rewarded. But, more often than not, the companies who are shown a vulnerability still seek to punish those who point it out to them.