I heard there are ransomwares that are sort of delayed action to frustrate you that even if you made backups, you don't know if those are infected as well, since they don't immediately lock down your files. Ah criminals, always ahead of everyone.
Guess you can compare this to counterfeiting money. Larger denominations would earn you more, while smaller denominations might not even be noticed. With bitcoin users, the really large ones would cause an alarm when hacked, while the really small ones are not worth the effort. It's about finding the Goldilocks zone.