> it seems they want criminals to make $0 so they stop doing that

And yet arguably the criminals are unwittingly performing a useful public service we might describe as involuntary pentesting with a financial penalty on failure. The ethical way to get rid of the criminals in this scenario is to institute competent regulation (ie not mindless box ticking) and enforcement.

Hypothetically we are all arguably better off with a ransomware attack if the alternative is a cyberattack by a geopolitical adversary at a later date.

How is that a useful service? This is only useful because the criminals exist and are doing it. Are killers providing a useful service because people then use protection so they don't get killed?

Or perhaps it is useful by hardening systems in case you enter a war with another country, but presumably the other country has the same problems so it's a zero sum game.