After a breach affecting thousands of institutions, Canvas's decision to reach an agreement with attackers highlights how ransom negotiations risk turning cybercrime into a predictable business model.