Taking down a system to reflash it with backups can take significant time that translates often in big companies to 10x-100x the ransom cost.

That's also why there are tensions between big companies / victims and law enforcement agencies because they have divergent interests: keeping the business running vs prosecuting and blocking criminals

Did you give data protection job a go? They're heavily recruiting people who can really make a difference. But it looks often easier than it is ;-)