On the other hand, it's not a critical security application. If someone breaks it, you just don't get a little money. If the exploit becomes widespread, you can update the malware.

The author probably wanted to be able to somewhat quickly encrypt/decrypt a full disk on potentially slow hardware.

Even a poorly-implemented homebrew encryption function would have been better than using a broken implementation of a common, trivially-recognizable function. It was easy for them to run this code through an SMT solver because it was easy to obtain the original source code.

It would have been smarter to bundle the ransomware with a 32-bit DOS extender so the known-good Salsa implementation could be used unchanged.

It's a way of sponsoring community-led crypto research.

My guess is that the authors wanted to ensure they could encrypt a full disk quickly.

Maybe it's just a test to see how quickly this was broken.