Reputational damage happens anyway, once news of the first breach/ransom goes out (which it will, it’s increasingly mandated by law). Second time around they might as well fold.

A prolonged extortion scheme can only be done on a low-scale highly-targeted basis, where you can ensure word doesn’t get out.