At a high level, an attacker views a vulnerable website as a juicy collection of resources that they can steal or exploit:
- It’s backed by a server that they can use to run their own programs
- It’s connected to the internet and likely has a squeaky-clean reputation
- It might include interesting user data
- It probably has traffic coming to it
- It is likely important to you
Most of the time, they use those resources to make money. And they continue to find new creative ways to make a buck.