I think this is correct. Criminals aren't stupid. It'd be much safer (in terms of risk of authorities coming after them) to have ransomware where the car just refuses to go anywhere, or drives you to a far-away location, until you pay up.

People will pay a fair amount of money to avoid a major inconvenience, but "my car won't start" is a lot less likely to have the FBI beating down your door.