They are a victim right up to the point that they provide material support for attackers who will harm others. Paying the ransom hurts others.

The good news, is if everyone stops paying then ransomware disappears and the risks go down significantly for everyone!