Even if you have good backups, you're still vulnerable to blackmail about public disclosure of data you're required to safeguard, just as in this case.

Paying up doesn't save anything, they still have the data and can release it anyway.

Backups are an essential part of the solution. However, for this case, one also needs the infrastructure, on isolated standby, to automatically revert every impacted device asap to stop the bleeding.

Didn't a company with backups recently pay because they realized restoring would take months?

"nobody pays"

This will likely require criminal penalties to enforce.

Which will never happen when 1) some law enforcement agencies themselves got affected and 2) as long as the ransom is less than the cost of recovery there's always the possibility for the payment to be done "underground" and off the books.