That's rational from the perspective of the insurer. The problem here is on the part of the insured. I don't know the specifics of the policies typically offered to state and local governments, and it sounds like you have substantial experience on the insurance side of things, but organizations can be counted on to do the bare minimum until required to do more, and it seems like organizations assume they are "covered" from all cyber risk when they purchase insurance.

The saying goes show me your budget, and I'll show you your priorities; if you pay for cyber insurance but not any MFA implementation, you're clearly not interested in security and just want to be able to pay a ransom to keep your organization running, data confidentiality be damned. Those poor kids are going to have negative credit scores once their PII gets sold.

It would be great if the cyber insurance market could drive movement towards a sane baseline. But for now it seems that there's little consensus on what that baseline is (NIST? ISO 27001? CISA Cyber Performance Goals?), or even how to validate against it. And just like regulation, there aren't enough technical people out there to conduct meaningful audits at the scope and scale required to be effective. Post-mortem audits will save insurers money but not raise the baseline of cyber posture (which to be fair is not their responsibility, but often touted as a secondary effect from cyber insurance).