They possibly could but a lot of executives would probably prefer that their soon to be ex-company took a hit than that they became personally liable for breaking a federal law.

“We purchased security consulting services who were able to decrypt our ransomware-infected files. We’re not sure of the exact method they used but it worked.”

Lawmakers have dealt with this problem for a long time. It’s well solved.

If they wanted to prevent this kind of behavior there are two straightforward approaches:

- make it also illegal for the consulting company to pay a ransom.

- attach Strict Liability to any ransom payment, even if made through an intermediary. The executives quoted above from the paying company could still face criminal liability for such a payment disguised with plausible deniability https://en.m.wikipedia.org/wiki/Strict_liability