There is a line where the ransom price beats the capex of keeping a secure system, specially when the risk so nebulous

Kind of like the recall math auto makers do to see if it's more expensive to actually recall a manufacturing problem, or just deal with it and compensate those who seek it personally