As a business owner, I can tell you that having a “cyber” rider on a business E&O policy can be eye-wateringly expensive.

As an infosec practitioner, I can’t tell you how many times I’ve seen someone have insurance and their security posture be effectively nothing, or the insurance not pay out even with reasonable measures in place. Market failure in my opinion, needs more regulation.

Agreed.

I’ve done a lot of infrastructure work, so my home network is...robust. Quite unusual; even for many corporations.

Two DMZs, three routers, three WiFi networks, two NAS units, etc. Also lots of redundant backups.

Our legal framework already contains many prohibitions on financial transactions with criminals and terrorists. It wouldn't be difficult to add one more.

My point is there are better, more reasonable ways to arrive at the same end goal: effective infosec practices that prevent ransomware attacks (among other threat actors).

Banning ransomware payments just makes it more difficult; someone will still find a way to save their business by paying. You want to resolve the root issue: a business not taking security seriously.