Looking out for short-term interests at the cost of long-term problems is pretty standard business practice.

Each school is looking at how much it will cost them if the data is leaked vs how much a ransom payment will cost and chances are it will be cheaper to pay the ransom.

You’re not wrong but, absent laws making paying ransoms illegal, each school is going to do what is in their self-interest regardless of the long-term effects.