Getting encryption right is hard, even if you're using a good algorithm. Somewhat competent people get it wrong all the time, and the people writing ransomware

Getting encryption right is hard, even if you're using a good algorithm. Somewhat competent people get it wrong all the time, and the people writing ransomware are often... less competent than that. Using a static symmetric key for all victims, generating individual keys in an insecure way, 256-bit RSA keys (not sure if this one has happened with ransomware, has happened with legit software), reusing the stream of a stream cipher, using formerly-believed-to-be-secure ciphers like RC4, ... It's not that hard to get the encryption right, but there's plenty room for failure, especially if you aren't an expert.