> Even if the ransomware perpetrators aren't selling the data, do you think there is any real chance that a company that just paid millions of dollars in ransom would next go and invest more money into security?

Yes. Or, they can get hacked again and pay another ransom until they learn their lesson.