If you get mugged you are coerced to give your wallet, on pain of _much_ greater punishment, usually the greatest there is - death.
If your company’s data is cryptolocked, you are coerced to give money on pain of getting that data lost.
The difference is that the punishment for non compliance is much different.
If you made paying a ransom in this case illegal you would actually promote better backup/restore/security practices, at the cost of sometimes loosing data.
If it was vital for that data not to be lost then not having adequate backups is a _much more_ serious problem as that data could be lost for different reasons. And you’re funding organized crime which has very bad downstream effects.
If you had to make a more adequate analogy, imagine someone stealing your personal documents then demanding money to get them returned - you should have a strategy to restore those in other events like fires and stuff, so you might pay money, or not. But if you do you encourage future theft like that for you and others, and that money might be used for some other, usually nefarious stuff.