When someone gets kidnapped there’s no CEO that can go to jail for a privacy breach. Data breaches typically stay out of the news, if it becomes public the victim company can face mask action. It can literally be cheaper the quietly pay the hackers.