There have been plenty of documented cases of crypto-related software having bugs which allowed for full decryption (including many examples of it happening in

There have been plenty of documented cases of crypto-related software having bugs which allowed for full decryption (including many examples of it happening in the land of ransomware which doesn't need strong encryption to extort money out of technically-illiterate people). If you are being sold a product which is based on a lie (let alone a lie that you won't pay criminals and skim money off the proceeds of the crime), then it is always the fault of the seller. Blaming the people who were lied to as being ignorant is a bit rich. (Also, RSA is not really efficient for encrypting large amounts of data. I'm willing to bet that most ransomware uses secret-key crypto like AES or ChaCha20 for the actual encryption and then transmits the secret key back to the C&C server or does some form of key-exchange to generate a secret key. Which means that the attacked machine had a copy of the secret key at some point.)