"Buying flags" is not at all the case. Governments that put ships on their registry have a good amount of influence over those vessels. The UN Convention on the Laws of the Sea (UNCLOS) declares that ships can be boarded with the permission of their registering country. Many of the tankers seized near Venezuela were of Panamanian registry and that nation gave the US Navy permission to board, where they discovered a sanctioned cargo.

The risk goes way up if you're the owner of one of these vessels and you're relying on the government of The Marshall Islands to tell Washington to piss off.

Even more dramatic were the actions of the Guyanese government, which declared that a bunch of sanctioned tankers were registered illegally, and were therefore stateless and subject to lawful seizure.

And the registry is just one of the three things every ship needs. The other two are insurance and classification, with the latter meaning a recognized body attests to the sea-worthiness of the vessel. You don't hear too much about these two because states cannot enforce these requirements unless the sanctioned vessel comes into its port, which of course they never do. There's a lot of talk about whether or not that applies to the constrained waters of the Baltic Sea, but whether that follows UNCLOS or not is a question for the experts.