Even if they were fast enough to avoid confiscation they would be leaving a trail. The IP with which they would register and connect in the exchange, the operations made and bitcoin address to which they would make the withdrawal later.
That presumes the hacker's decide to send them when the heat is still on, if someone sends the coins years down the line when no one is watching besides the few government agents who keep track of registries then they could execute a quick transfer before people wake up to it.
Kind of like criminals who deal in Fine Art or I guess in Modern Terms ISIS artifact resellers for Palmyra objects.
(But I agree by all accounts the amount these recieved was small but I am guessing they will be Holding it till it reaches a million or so and the ransom value appreciates over time.)