If they spent the money in the right places, i.e helping people or organizations get back on their feet after a breach, that would be more fruitful. This whole 'we're gonna sit in your computer chasing bad guys' is just shenanigans.