U.S. companies may have to learn to live with ransomware attacks — even if that means paying ransom, speakers told California lawmakers.