The fact that they have cyberinsurance is one factor in making that decision. If the "co-pay" is only $10K on $500K that makes it sound like a pretty good deal, as long as they don't come back for more.
I'm also thinking that the cost of cyberinsurance is going to be going up with the number of attacks and payouts.
Lately I've heard law enforcement saying that you should not pay, since there is no guarantee that the hackers won't be back for more. Speaking of costs going up, it is also apparent that hackers have added a zero to their ransom demands. The money is good if you can get it!
Steve Myers shared the link above.