It should be illegal on another basis as well. Paying it contributes to a norm that randoms will be paid that will encourage more randomware in the future again

It should be illegal on another basis as well. Paying it contributes to a norm that randoms will be paid that will encourage more randomware in the future against other companies. So you're harming other people when you pay it. That's an externality that won't be factored into the decision to pay the ransom. Suppose god handed down powers that allowed you to smite from the earth anyone who ever paid a ransom with perfect accuracy and you made a credible commitment to do so. If this fact was well known, presumably random-paying would disappear overnight and ransomware attacks would soon cease to exist as well (ironically rendering the power to smite ransom-payers redundant). We won't ever live in that world but we can move marginally toward it by severaly penalizing clear cut cases where a company or individual pays a ransom.