This is precisely one of the dangers of vigilantism and mob justice. In a civil society, it is up to the criminal justice to pursue criminals and discipline them, not the internet mob.

These criminals are being protected, either deliberately or through apathy, by the Russian government. There is no other recourse.

To be honest, I’m not sure this is the case. Russia does not extradite its citizens (this is written in Constitution), so the only way to prosecute criminals is to report the crime to Russian authorities. Extradition request is not a crime report. Question: did someone actually try to report cybercrime directly in Russia? Ransomware cases would be interesting also for tax authorities (at least from this perspective the case will be within Russian jurisdiction).

What if there were Americans being 'protected' by the American government for doing something legal in the US, but illegal in other countries?

Cybercrime is not legal in Russia.

War crimes are not legal in USA, but USA codified in law non-cooperation with ICJ on that matter. Does it mean we should start publishing personal data of US military?

If you honestly believe there's some sort of equivalence, go ahead. Don't blame me for whatever consequences you face.