ae64

I don't believe that's entirely true, Facebook has endless channels (e.g. messenger) in which they could introduce or increase their advertising frequency (think Forbes). They could even disclose to end-users that these additional advertisements were being served specifically as they are within the EU, similar to the ubiquitous cookie pop-ups they are already well adjusted to seeing.

At what cost? Would displaying significantly more ads to EU users to offset the regional tax hikes be worth the revenue raised?

Simplest solution: payment put into escrow, ransom is released to the ransom holder after 365 days provided the source code is not leaked, the ransom is released to the victim if the source code is leaked prior. If the ransom holder released the source after the fact it would be a year out of date.