You are comparing apples to oranges, or maybe even skyscrapers. A company can (for example) pay $1 million ransom to save $10 million in costs. Now the same government that cannot catch the criminals doing this want to say, no, you can't save that $10 million. Sounds a lot like punishing the victim to me. What does that have to do with violating my privacy? In that case the person having their privacy violated is the victim to the extent there is one.

Even if laws were enacted against paying ransom, I doubt such laws would involve jail time. Who would you jail when a corporation pays the ransom anyway? How would you prove who paid the ransom when it is paid via a crypto, especially one with strong privacy features? Neither the attackers or victims would be motivated to tell anyone what is going on. Attacks would still occur, ransoms would still be paid, you would just stop hearing about it in the news because those involved would keep it quiet. Seems like there is very little risk to those paying the ransom, at least in terms of being caught by the government. Assuming the law did not involve jail time, then a company would have to weigh the likelihood of being caught and the likely fine against the cost of paying the ransom and against the cost to the company if they don't pay the ransom. Most companies paying ransoms are doing so because it is saving them a massive amount of money.

Assuming such a law somehow managed to be effective (which again, is where we disagree...i don't believe it would be effective...at least not effective enough), it would still punish victims unless it was 100% effective.

In the long term I think this will become less of an issue without punishing the victims because companies will enact better procedures to prevent such attacks and better procedures for recovering from them without the need to resort to ransom.