He’s not blaming the victims for getting attacked by ransomware. He’s blaming people who then pay the attackers. That’s a separate issue. People can be both victims and perpetrators of separate offenses, subject to criticism. I.e. being a victim of one thing does not render you blamless for all your subsequent actions.