It isn't just hackers. The largest western dnms primarily use xmr and none of them use zcash. Even more eye openjng, look at clearnet tx data. Monero mogs Zcash. For hacks or ransoms, the technical reason for xmr dominance over zcash is because shielded adoption of zcash is abysmal. Hardly any coinswaps support it and near intents will just freeze any large funds immediately. Because xmr has dealt with delistings for a while the community has adapted for non kyc methods.