Earlier quoted context omitted.
Not a game theorist, but this is probably the same reason "ransomware" actually does unlock your data if your provide the BTC -- if it didn't, people would not pay. It's market forces at play and is what distinguishes organised criminals from garden variety criminals. (Sorry if that is stated in the article, but there is a pay-wall.)
But that assumes the kidnappers have a long-term game to play, and need to worry about their reputation, no? That will be the case at least some of the time, I suppose. Also, some 'ransomware' never unlocks, even on payment. 'NotPetya' is the famous one, perhaps there are others. A sufficiently spooked victim might behave irrationally and fail to research the ransomware's track record before paying up.
Kidnapping is a business. I would assume people who kidnap others do it more than once. If you want your industry (kidnapping) to continue to exist/be profitable, then would-be-payers must know that they are likely going to get the person(s) back.