Re: Cyber Insurance?
Without wading into whether cyber insurance specifically is valuable or a hindrance or an indirect facilitator in the furtherance of crime, let's discuss insurance in general.
So, first issue I'll point out is the assumption that the insurance company is exposed to open-ended costs. All policies have maximums, period. Maximums, per individual policy can vary, but is proportional to the policy's premium paid.
Tangentially, unlike a physical property insurance carrier as a counter-example, who may have hundreds or thousands of claims during a specific weather event over a specific geography (think tornado, severe hail storm, hurricane and the like), one cyber insurance claim likely has nothing to do with the next claim. Therefore, a single cyber insurance issuer is likely to experience a claims due to a single catastrophic event.
And while I'm no expert in insurance (or really anything), there's insurance for insurance companies, called reinsurance - further distributing the financial burden beyond the insurer. And beyond that, there's a whole bond market colloquially called "CAT" bonds, or Catastrophe Bonds that helps further distribute exposure from any event across even more entities.
At the end of the day, there's not too many insurance companies that go out of business (at least those that are well run - and that's not the topic of this response). That's because they know how to manage risk [0] and adjust their exposure and premiums appropriately.
[0] There's been a whole bunch of insurance companies who did property and casualty insurance over the past half-decade who have gone bankrupt. While I haven't dug into the specifics of any one company - I'd suspect that some of those failed insurance companies fell into the same rising interest rate trap that caught a few banks who failed during the same time frame. Insurance companies, if properly run, bank a crap ton portion of their money in various investments and other hedges against inflation.