It's a bit cursory to draw conclusions based on just whether someone purchased insurance. One of the issues is the degree to which insurance will cover all your costs or if there are caveats. The fine print is getting finer. Insurers aren't covering ransoms paid, regulatory fines, etc. I can understand how when the numbers are run, in some cases, it is more cost-effective to just accept the risk than insuring against it.
