Because why would anyone pay anyone if they were going to do what they threatened you with anyway?
The deal becomes a subscription not indifferent from any other cost of doing business. Great for the hacker. Bad for the IT team incapable of anticipating these attack vectors.