Diminishing returns, running spam botnets is already so risky that making more enemies by graduating to ransomware probably doesn't make a perceptible difference. Do you go to prison for 25 years or 30?

Sure, you could probably deter ransomware by sending DEVGRU to murder the authors, but I doubt it's worth the political shitstorm that'd follow.