I sort of suspect this is just the result of a nation state that is willing to be a pariah. That is, I think nearly any large state could do it if they didn't mind burning bridges.
Does anyone remember LAPSUS$ https://en.wikipedia.org/wiki/Lapsus$ from a while back? It was reported for a while that it was largely made up of teenagers, and it seems two did get caught. I recall their whole MO being brazen social engineering/using stolen credentials in a way that got them caught pretty quickly, but also got results fast.
Crime being illegal doesn't prevent crime, but it adds an enormous amount of friction. In the West if you are decent at hacking, low-level APIs or reverse engineering you could turn to cyber crime. But if you instead get a regular job in cyber security or software engineering you still get a good salary, and don't have to worry about your online friends being police informants, can tell your potential significant other what you do to earn a living, get money wired directly to your bank account instead of having to go through costly intermediaries with significant risks, don't have trouble with the tax authority, etc.
If you reduce the legal opportunities and remove the downsides of the illegal ones the calculation completely changes, and with it the talent pool
The world doesnt make sense if you ignore history.
They probably hack for the same reason the west does it: attack/defense and money.