I mean it's not like these people are operating under " long lived identities and want to build a long term business relationship with you.

From their side, the logic seems as simple as: repeat the attack -> some chance of more money, don't repeat the attack -> 0% chance of more money