A lot of cybercrime is like that, the police are very incompetent at handling it. I've seen a criminal literally logged in with their personal account (with 2FA, home address etc.) and the case was dropped because they wouldn't/couldn't identify the person. I don't think they even attempted.

Botnets are annoying to dismantle even within the EU, it's not even illegal in some countries to not remove reported malware.

I view such legislation as an excuse to their general incompetence.