Ransomware shops don't sit passively by, waiting for someone to install a trojan. Some of them are actually outsourcing the actual penetration, according to Krebs:

https://krebsonsecurity.com/2020/10/amid-an-embarrassment-of...

And once you're doing that, you're going to minimax for hi-value, low-risk targets.