This isn't an Apple issue. This is an idiot end user issue.

"Users who have a passcode on their device appear to be able to unlock it after the hacker has sent them the message demanding payment, but those who had not set a passcode are unable to."