This isn't an academic argument. There are many cases where company leadership knows the people and computers behind the botnet / ransomers and has to just sit there taking a beating. Not everyone can farm this shit out to Cloudflare.