What you're suggesting ultimately results in the government forcing private companies to harm their own customers and their own brand image. I get where you're coming from (a plant that gets no water stops growing, after all), but this law would quickly become unbelievably unpopular among victims of identity theft. Companies would likely spend more lobbying to overturn this than they do on the ransomware payments themselves, because the reputational harm they'd suffer would cost orders of magnitude more than the ransomware and lobbying anyway.