A $28.7m demand generates a board meeting, a law firm, an insurer and eventually a public record. A $40,000 demand generates a wire transfer.
If the demand is a function of revenue, the volume figure attached to it is decoration — and the attacker had no incentive to count accurately.