If it is criminal, then sending it risks their job, future employment, and freedom. Not sending it means they are simply following the law like everyone else. Nobody gets fired for doing what everyone else must do.

It is not about spending vast amount of taxpayer dollars on prosecution. Likely just one will send a message. But stopping the payments will help everyone, to the tune of hundreds of billions of dollars. Otherwise our tax dollars goes to fighting ransomware in ways that are not effective. This is actually better for the taxpayer.

Keep in mind, many of these 'companies' actually provide critical infrastructure to citizens: clean water, electricity, Internet, gas, transportation, food supplies, etc. Impacts to them translate to great impacts to all citizens.

Criminalizing the payments creates a forcing function for business to better protect themselves while it greatly undermines the motivation for attackers, thereby reducing the number of attacks. It is an effective and efficient way of reducing the risks of ransomware.