I think that's fair. At a previous job from years ago, we took a meeting with one of these ransom payment-facilitator companies. I got the impression they were probably legit and just trying to help companies who knew nothing about cryptocurrency quickly recover from attacks.

However, some percentage of these firms definitely are basically part of the ransom racket and essentially act as intermediaries for ransomers. And of course, who knows if my gut feeling of legitimacy in that one particular case was correct or not.