It's an asymmetrical game of tit-for-tat. If the hackers don't keep their word often enough the companies won't play the game again. Pay regardless of the hackers keeping their word and you make yourself vulnerable.