Just about every exploited site I've had to deal with has been some form of crypto miner.

Sure, because there's no reason not to, and because crypto mining is noisier than data exfiltration.

That doesn't mean it's the most lucrative revenue stream.