No law will stop EVERYONE from paying ransom. In my opinion such laws would be ineffective and in reality wouldn't stop ransom from being paid. Again, how would one go about proving a company paid ransom, especially if paid in an anonymous manner? Such laws could even be counterproductive. It's better for companies to be able to freely admit to it to give law enforcement a chance in hell of tracking the money. There are kidnappings for ransom too. Unless the penalty is death, families will pay the ransom if they are able. Honestly, it isn't THAT hard for a company to have a plan in place to recover from such an attack in a manner cheaper and safer than paying ransom. Let company's learn their lesson and figure this out and let law enforcement go after the attackers. Company's can mitigate their own risk.

Providing material support is not what harms others. The attackers are what harm others and should be the target of law enforcement. You could use the same argument for paying taxes. Unless you think paying taxes never harms others.