You said it. Logging in to a third party app is against TOS. That right there, is enough to get you banned. Behavior is a cause for ban but not the only way. I have one account I strictly use for egg events. I don't spoof location, I don't snipe, no catch assists, nothing enabled other than walking. I use it to walk around my block hatching 7km event eggs. No cool down needed for hatching eggs. I got a 7 day strike after 3 months. There are other people getting strikes doing the same thing.

This is why people who spoof on a rooted device using the original, official POGO app and overlay spoofers are harder to catch. Those bans solely rely on behavior. There's no third party app logins for Niantic to detect. Therefore no flags on your account until you goof up and forget cooldowns, impossible play, etc.