Many security experts and the Federal Bureau of Investigation caution against paying ransomware demands. Colonial Pipeline paid about $4.4 million, got its systems back online and will get some of the money back as well.