Many companies now pay for this kind of insurance. So even though the company may not seem like they have the deepest pockets, it's really more about paying the insurance premiums and the insurer pays the ransom.

I recall a colleague whose firm was hit by a ransomware attack. When they reached out to the insurer and sent them the details of the attackers, the first response from the insurance agent was, "Oh good, they are a reputable group. We've worked with them in the past. They will simply take the ransom and return your network/files to you." My colleague was shocked by the nonchalance.