What are all these spam subscribers doing here?

I’ll try to answer even though the questions are a bit generic:

1) Should I check anything else apart from deleting the new users and
fixing the setting?

When deleting a user from the admin, WordPress asks you if you want to keep or delete any associated post for that user. Independently from that, it also takes care of cleaning up the database (like removing user settings etc). So no, you don’t need to do anything else.

2) What do these (presumably spam) subscribers get out of the deal?
They get no access to the site, as I understand it, and no eyeballs on
any spam they might want to push.

Most of the time they are just “random automated attacks” to gather as much information as possible, like the installed WordPress version, checking the existence of email addresses, having the ability to post comments etc…