I'm not sure, I spent five minutes thinking about it, and it's pretty easy to come up with a design that relies on no servers, accepts payment through Bitcoin and the decryption keys are only ever stored with the operator and never divulged before payment.
Maybe malware operators aren't that experienced, who knows.
I don't know about Coinvault, but other systems would generate the private key on a server and send the public key to the computer for encryption. I don't see how you could have zero servers and still send the private key upon payment, though.
Maybe malware operators aren't that experienced, who knows.