For those who've actually sat through a ransomware tabletop exercise, useful, or just theater?

I've spent a few years doing incident response and negotiation work around real ransomware cases, and "we run tabletop exercises" is the answer I keep hearing from leadership whenever prevention comes up. But I'm curious