Dealing with ransomware can be a legal balancing act for executives, according to a lawyer who advises victims.