They probably tried passwords they got form other hacked sites. But they tried them on iDevices they "found" where the owners failed to create a passcode. They could then "easily" send the ransom note. I haven't heard of anyone actually having their iDevice wiped but that is possible once the Apple ID was verified. That's why changing your Apple ID is a save guard for this event. Of course, if it is absolutely never used anywhere else, it
should be fine. Apple has, reportedly, denied that any of those ID's have been stolen from iCloud. But if the ID was 'discovered' in use at another, hacked site, iCloud storage access is not needed.
A four digit password is not considered safe in any criteria I know of, but that is what the vast majority of iDevice owners use. That is only 9,999 combination since the only characters are the ten digits. Using the stronger method allows all the characters on the keyboard to be used; 52 letters, ~30 symbols and punctuation, plus the ten digits and with a much larger length. But Apple didn't even make that available in the first versions of iOS!
My opinion: "find My..." Is not the problem, weak/short passcode and using your Apple ID anywhere except at Apple is the problem. YMMV.