Doesn't making it illegal just change the cost structure? The penalty for illegally paying a ransom in your proposed system would be simply to pay a fine. It's effectively how a rich person might look at a parking ticket for a premium parking spot - it might be cheaper for them to simply pick the illegal spot than to have to drive 2 miles away and call an uber to get to their destination.
No offense, but this proposal is essentially DOA.
As for size of fish, we don't go "why is theft illegal when there are murderers still roaming around?" We can have both be illegal.
But the stories of hospitals and other entities paying non-trivial sums in ransom I would expect are mostly professional criminals, not hackers doing it for lulz.
Enforcing a fine relative to the ransom paid (and maybe relative to the "if we wouldn't have paid it" severity) is probably a good immediate start. This would at least galvanize businesses to improve existing security.
Every single thing done by a government, or really just any large player in the market place, is going to have small businesses that get flattened by it. That your entire company could be wiped out by changes in the marketplace, including laws, is one of the risks a person assumes when they decide to start a small business instead of working as an employee. They're earning their slice of the money pie in part by assuming that risk.