I apologize for not being clear; I did understand your meaning.

For many organizations, it's safe to say that they do not believe that they can do this without suffering catastrophic financial losses, losses far greater than those caused directly by the ransomware attack. Whether or not that's actually true is a different story. The reputational hit that comes from a shutdown can also be perceived as being too expensive.

"(2) Restore from backups"
Not a sure thing. One of my colleagues got hit, and evidently the ransomware was injected months before the attack, so the backup was infected also.

Certainly the quicker you discover a problem, the more likely you are to be able to fix it. Different backup strategies can help. For example, my backups are automated. I keep daily snapshots for six computers on my backup server. Those rollover and are replaced with newer backups when the disks get full. Currently I have a bit less than a years worth of daily file backups for each computer available. And half a years worth of monthly image backups for the Windows computers (I don't do image backups for the Linux ones). This is a more sophisticated backup system than most people have at home.