> Notorious for paying below market in engineering and IT

Why assume that good people are only driven by money and pay? Further that good people know all the opportunities and can get a job paying better? Also there is no evidence that I have seen that the places that pay better don't suffer from cyber attacks or ransomware.

A bigger part of the problem (maybe) is the fact that there is a vast amount of info published which helps people improve their hacking skills and make more attacks possible than would be the case if that info was not as easily available. (Note I did not say anything that indicates it wouldn't still be possible or happen but that it wouldn't be as easy to do).