But is it unethical, let alone illegal?
K&R consultancy is an established, respectable market. Senior executives and wealthy individuals often carry K&R insurance; in the unfortunate scenario of being kidnapped, the insurance carrier pays for a specialist K&R company to negotiate the release of a victim. Kidnappers - allegedly - prefer dealing with such individuals as they know that they will be paid, there will be no Police involvement, and that a payment will be made (at low risk to them).
This is little different. And I suspect, if Dr Shifro's track record is >50%, that the miscreants behind Dr Shifro prefer to deal with him; if he is contacting them then they know the victim has paid, and that it is in their long-term "business" interests to provide the key.
Untasteworthy business, but Dr S can be considered the IT equivalency of a K&R consultant.
What is at fault is the marketing/advertising of the provided "service". Change that, and the business is legitimate.