This is a fundamental misunderstanding of the ransomware business. The whole reason people pay up is because the hackers don't run and leave you hanging; if you pay they will decrypt your data. Trust and convenience are essential to making this work.

Perhaps a few cases of high-profile companies falsly claiming „wow, what a load of shit! we got ransommed and after paying up the hackers disappeared! we had to restore from backup, AND the money is gone“.

What are the hackers gonna do, sue those companies? :-)

Oh yes they can.

Also, assume you have the key - what you do with it? You don't know how the files were encrypted, in which way they were stored afterwards, etc. There are many ways one can encrypt and write data, even with the same key - you obviously need the algorithm, but also there are often parameters (e.g. block sizes), storage formats etc. The easiest way to deliver all that is to provide a program.

Otherwise, what a random "press any key" IT person would do with an encryption key? They probably don't even have any tools that can do encryption on any of the systems. Do they have to write those themselves? Use OSS tools - which ones? With which parameters? What if it doesn't work?

Uh, why? The system is already compromised. They’re already in.

One would hope they'd just run the decryption program on each computer, not connected to the network. Or maybe hire some experts to extract the decryption key.

That would make a lot more sense but I also bet there's a non-zero chance that in a day some dumb media outlet will conflate those tools as "hacker tools" and the headline will be "Hacker tools used in Colonial pipeline hack available freely on Internet. News at 10."

Thinking $5m is a "high" ransom, thinking that there is no way they would send a decryption binary rather than a key.

Why don't you just actually research how these schemes function before commenting? The team that did this has a pretty consistent MO and five million was a massive discount.