So the solution is to pay ransom and be forever at risk of being crippled by anyone with access to a computer? I'm not sure why it being a "private company" has anything to do with this. They certainly have the option to pay a ransom.
The fact that they're a Private Company means that they had the Right to pay the ransom if they wanted.
We can criticize their decision but at the end of the day, they did what they felt was best to get their computers back online.
The point is that when it comes to certain "private" companies like those that supply gas and utilities there is a national security interest that extends beyond the interests of the private company. Only the US government has the resources and intelligence apparatus to keep this from happening over and over again. Russia is not going to invade the US because we make an issue of it by shutting down a factory or down. That is the language they understand. Putin wants to retain power and keep his rich friends happy. When their interests are threatened the result would be that those responsible for these hacks will end up in the Gulag. Weakness, however, is what creates further risk.
You're missing the point.
Russia has the ability to retaliate and shut down our factories and infrastructure. There's no evidence that our Cyber Warfare capabilities are superior to Russia's.
In a Cyber War, there would be no winner so escalation is against the interests of both the US and Russia (the same logic applies to Nuclear War: Mutually Assured Destruction).
We don't for certain know that the Russian government was involved in the Colonial Hack. Biden says it didn't involve the Russian government but for all we know, he could be saying that to save face. Afterall, it came on the heels of Biden's sanctions on Russia for the SolarWinds Hack. Which would mean Russia doesn't feel threatened by our retaliatory actions...