There's many circumstances in which one party breaking the law allows another party to _legally_ perform actions which are typically not allowed.

For example, it is illegal to kill another human being. However, nearly all jurisdictions recognize "killing in self-defense" as permissible, if unfortunate.

I can't say if the same argument applies in this situation, but I _could_ see some parallels. If a malicious party is willing to cause you financial harm for their own gain, and you can reasonably prevent this financial harm by quickly inflicting equal-or-less harm on them, perhaps that's justifiable.

These situations exist but they are actually pretty rare. As lawyer can tell you, in the modern legal system attempts at "self-help" are generally bad for the plaintiff.

Seems like these days, the expected strategy is to let things happen and delegate making you whole to insurance and the legal system.

I can see how this is better - especially for society in general - than taking things into your own hands, but then insurance sometimes will try to screw you (is there insurance for insurance?), and lawyers are prohibitively expensive for many.

This isn't an academic argument. There are many cases where company leadership knows the people and computers behind the botnet / ransomers and has to just sit there taking a beating. Not everyone can farm this shit out to Cloudflare.