They use affiliate systems and provide ransomware (that someone else has probably delivered) to the people actually doing the breaches.

It wasn't darkside planting the ransomware afaik, but it was someone wanting to get paid through their affiliate program.