IDK. From a certain point of view, you could view them as doing a service. What if a different kind of criminal had used these exploits? Not one that wanted $3

IDK. From a certain point of view, you could view them as doing a service. What if a different kind of criminal had used these exploits? Not one that wanted $300 in bitcoin, but one that actually wanted to cause harm? They could have deleted files and never given them back, and they could have stopped any software running on the machines.