They are likely based in a country not regarded to be a technology leader. Say you were the CTO of a firm looking to improve security, would you engage a Nigerian cybersec consultant? Almost certainly not, you would look in your home country, or the US/Europe.

If they were to start a consultancy, even if they are as skilled as anyone else, they’d have an uphill battle from the get go; and have to either stick to their home market, or heavily discount their services. Either way making less than from their ransomware.