This is a bit simplistic my educated guess is in Russia, Ukraine and prob some other countries given pay structure in 3 letter agencies they simply can not afford hiring proper skills for the cyber sec especially for the offensive side. So they have a hybrid private/gov system where certain groups get some level of immunity for their "commercial" activities in exchange for deploying their skills for 3 letter agency use when needed. Alternatively people who are caught for some criminal activity get their sentence suspended in exchange for services.