Incident response firms negotiate with hackers while also processing payments to them, leading to potential betrayals of their clients’ trust.