Out of curiosity. Why do you mention the latter group (people with good information opsec) is tiny when the former group (criminals) is probably an order of magnitude smaller?
"in 2020, there were 1.8 million people in prison" [1]
"[in 2019,] the country’s total employed cybersecurity workforce is just 716,000" [2]
"There are about 465,000 open positions in cybersecurity nationwide as of May 2021" [3]
[1]: https://easyreadernews.com/why-are-so-many-americans-in-pris... [2]: https://www.csis.org/analysis/cybersecurity-workforce-gap [3]: https://www.cbsnews.com/news/cybersecurity-job-openings-unit...
How did you arrive at that? Even a significant fraction of people I know who do security work would agree they don't in general have good info opsec, because it's a pain in the ass. Most of the technical people I know wouldn't even know how to do it properly.
"Criminals" is hard to define precisely, but some small integer percent is at least a reasonable lower bound. Afaics people who are actually good at info opsec don't number in the millions.
So even if we simplify by assuming the rough magnitude of both groups is the same, you still have the intersection of two small groups -> tiny. This is probably complicated a little bit because criminals have more incentive than average, if not more experience.
tiny * tiny = very tiny