Interestingly, it looks like (some) insurers may be responding to this.

> In an apparent industry first, the global insurance company AXA said Thursday it will stop writing cyber-insurance policies in France that reimburse customers for extortion payments made to ransomware criminals.

https://www.insurancejournal.com/news/international/2021/05/...