What's the end result? Prosecuting the victim of a cybercrime for paying a ransom?
The way you get there is prosecuting the victims of cybercrime for paying a ransom, if any are stupid enough to break the law.
I'm not even arguing for a specific policy, but I didn't like how the framing of the post was about being "stupid" enough to break the proposed law. It wouldn't be that simple.