However they don’t really need to because there are plenty of documented cases, and the incident response company you hire will almost certainly have prior knowledge of the group you’re forced to deal with.

If they had a history of fucking over their “customers”, the IR team you hired would know and presumably advise against paying.

Yes, the data might still leak. It’s absurd to suggest that it’s not less likely to leak if you pay.

There’s a reason why businesses very frequently arrive at the conclusion that it’s better to pay, and it’s not because they’re stupid or malicious. They actually have money on the line too, unlike almost everyone who would criticise them for paying.