Some people might think their IT department is fully omniscient (or competent in other cases) and knows every flaw they could be targeted by which is why it would make sense to hire an external firm to audit you.

> Which is why you wouldn't pay it in the first place

Currently, ransomware operators could just decrypt half your files upon 50% payment, and demand yet another payment for the rest. But they don't. Why? Because they seem to have naturally converged upon honoring their decryption payments in order to maximize total profit. I think if paying the ransom was made more explicitly illegal, the ransomware operators would probably converge on not outing their clients. At least for now.