There are strict privacy laws (e.g. FERPA) which university administrators are terrified of violating and getting sued over.
Meanwhile, most university "enterprise" software is a festering pile of shit.
I'm very surprised by the extortion attempt, but sadly a massive overreaction doesn't much surprise me.