I presume that at least some of them just log the host as accessible and maybe some basic statistics into a list for an actual person to look at later on. That actual person would be the one to look more closely to see if there are any interesting credentials to steal or important data to steal or ransomware.