There are chains which end in espionage, but the volume pales compared to ransomware, identity theft, and carding. Too much money to be made.

That sort of thing tends to involve much more individually targeted attacks- emails, fake ads on Facebook targeted to a specific email address, etc. Throwing up a fake weight loss website to infect uncle bob's boob viewing machine isn't going to get very far in the espionage game.