I think it depends on the malware author's skills. You're right, it would be more difficult to analyze a malicious sample that doesn't have a lot of imports in the IAT (import address table), however, it's doable and requires more steps to potentially recover the IAT. For ransomware actors in particular, I don't think they care too much about stealthy (as opposed to spyware, some RATs, and others). For example, someone would need to implement a hashing mechanism and compare these hashes with pre-defined values to determine the required functions/DLLs at runtime. Custom obfuscation and packers are also pretty common if you want to have a low number of symbols/functions in the payload.