Imagine the city you live en being bombed daily by an enemy airforce. Then you discover (after losing your house) that the neighbour paid the attacking airforce to avoid his house.
A better analogy would be that this is like someone's business getting robbed, and being punished for paying the robber who flew overseas to ship it back to you. But still, this is different, more complex, and more nuanced.
Which is way more reasonable than it sounds. Put differently, it incentivizes companies to get their security in order. Keep in mind the arguably larger victim of these attacks is the public who may lose their own data or security which they have entrusted to these businesses.
We have an expectation of due diligence from firms. If you're a company that rents storage space and you keep your property unlocked and you lose all your customers stuff it's not just the thieves who are in trouble.
