Yep, that's exactly it. There are a bunch of possible permutations/optimizations, like initially keeping the original header with the max age changed to 1 for a

Yep, that's exactly it. There are a bunch of possible permutations/optimizations, like initially keeping the original header with the max age changed to 1 for a shorter period of time (until you're confident that the number of user reports will be small enough not to get on anyone important's radar before it's too late, and/or maybe you have some more complicated logic to track which clients do and don't have the altered header); but in any case the general point we made in the talk was just that enabling HPKP (among a few other things) was a net positive if you were worried about getting hit by RansomPKP today, not that it would entirely prevent the attack.