Ransomware negotiator hired to represent victims was working for the attackers

When ransomware collusion pays millions, it completely breaks corporate salary incentives. How can compliance ever stop an insider threat when betrayal becomes the economically rational choice?