I can’t say anything from personal experience because luckily I never needed such a service. What is a problem is the advance payment, and the uncertain outcome of their rescue attempt, and in my opinion it only makes sense if the amounts are really large and there is no other way.

Furthermore, such investigations can only be successful if the hacker did not use mixing coins and all other available methods to cover up his tracks - because then I don't see how anyone could find out where the stolen funds are. Anyone who is hacked has the ability to try to track transactions, and if they find that funds have ended up on some crypto exchange they can try to block those funds and initiate a return process.