Sounds like they’re the ones who implemented the bad code in the first place, as a honeypot. That just extortion with extra steps.