Although paying only for recovery requires a lot of access to internal accounting information to ensure that the victim is actually paying for recovery and not paying off the gangs in secret. And there's a pretty strong motive for the victim to do this.

While I find insurers are far too often in the category of scammers (e.g., see recision of fully paid health insurance policies on bogus criteria after an insured person gets an expensive disease), I don't envy them here. I don't see how an insurer is to make a product profitable (i.e., worth selling) when they are specifically & systematically targeted by these gangs.