These firms promise high-tech ransomware solutions—but typically just pay hackers