It is not intended to punish anyone but the criminals. Enacting this would greatly reduce all Ransomware, helping protect all potential victims.

Something similar was done for Privacy. EU made it illegal to collect and sell users data without their consent. A grace period was given for companies to properly adapt. The same can be done with outlawing the paying of ransoms.