I've wondered why copyright holders don't do this more in general. I've seen a few cases where a downloaded movie for example just gets borked towards the end ... presumed it was deliberate and surely some form of a deterrent!
It did not take long for me to realize how crazy I was being over this. My time was better spent improving the software and focusing on customers who would pay.
Also to be fair, even if the cracker wasn’t paranoid I expect doing it in a VM is much more convenient since you can trivially reset your environment.
They got the logins for some other websites they did not had access to before. Logged in and found out how they could generate the keys.
At least that was my understanding.