I agree, this is a classic do as I say not as I do situation. Punish businesses for paying out ransomware ransomes meanwhile the government(mainly local, but sometimes larger) pay out routinely when their systems are compromised.
E.G. http://pulse.ncpolicywatch.org/2021/05/12/as-nc-lawmakers-fa...