So, you would prohibit constructs like key person insurance [1] or cyber insurance [2] that have clauses for settling ransom payment claims for kidnaps or extortion after a data breach?
These already exist.
[1]: https://www.travelers.co.uk/iw-documents/uk/documents/kidnap...