Plenty of profitable med spas are operating on a structure that wouldn't survive a regulator's afternoon. The reason is the Corporate Practice of Medicine doctrine — CPOM — and the fact that most owners learn how it works only after they've already built the business on top of a structure it prohibits.
Here's the uncomfortable framing. In a strict CPOM state, the question regulators ask isn't whether your med spa is well-run or whether your outcomes are good. It's narrower and more dangerous: is the entity that collects the patient's money, employs the injector, and controls the schedule even allowed to be in the business of medicine? If a non-physician owns that entity, in many states the answer is no — and "but everyone does it this way" is not a defense.