How do we know that they (MonsterCloud) weren't also the criminals on the other side of the bitcoin transaction?
Is it possible this was all a giant payola/extortion ring?
I mean, the criminals were just that reliable, organized and scrupulous about unlocking their victims?
It certainly is not impossible that the decrypting company would be so scummy but it is in the same vein as accusing a home security company financing burglars to go on rampage.
This opens up one of those weird moral dilemmas akin to asking whether it's moral to hack someone's exposed device to patch a security hole: Would it actually be a net positive to create a ransomware variant that had no decryption key, but acted like it did?