I believe that most people pay. It is perceived to be cheaper to pay off the extortionists than to mitigate the DoS attack.
What's the logic behind this? After all, DDoSers probably aren't upstanding citizens.
Think of it as entering into a subscription arrangement.