For the cyber-criminals there is little or no per-user cost to implement this attack. The refuse-to-pay strategy works when there is some hope of making their attack not worth their effort. To make it not profitable, you would have to convince such a high percentage of people to not pay that the refuse-to-pay strategy is intractable. Instead, we need to rely on the FBI and other organizations to raise the risk of getting caught.