Gangs are multiple people, they have higher expenses (can’t go to a normal bank, have to pay off local police, etc.), and the long-term prospects are risky so they need to get rich and find safe places to store the money after laundering it. Plus every so often you get on the wrong side of someone nasty and end up involved in something much riskier or dead.

Even if you’re completely amoral, getting a hefty paycheck, 401k, etc. is going to be appealing to most people with that skill level. It’s not a coincidence that a lot of this happens in places where people have poor career options which makes that more appealing.

Hacker gangs also apparently lose 2.4 million dollars at the drop of a hat, which is something that no security consultant ever has to worry about.

Those gangs aren’t one person, and neither are the IT security companies that are making tens (or hundreds) of millions.