I believe the move by AXA was based upon their view of the challenges in the current cyber insurance market, related to competing pressure in the regulatory environment and from law enforcement.
There are cases I have worked where threat actors intentionally search through a victim’s infrastructure and data looking for whether the victim has cyber insurance. Some threat actors actually use the data from the victim’s own system in the ransomware notice indicating that there is no reason not to pay, because they are insured.
An argument could be made that cyber insurance emboldens the attackers, so limiting payments and coverage could discourage future attacks.
I believe the trend and the more likely response will be more to limiting cyber-ransomware payout amounts and certainly requiring policy holders to have and maintain a higher level of cyber maturity, conduct better and more regular risk assessments, and more closely align coverage to threats, which is in my opinion the better way to respond to cyber extortion than just simply halting payments.