(replying to myself)

After walking away from this I thought of an analogy to fit the other side: Attractive Nuisance

Maybe a security researcher/group/company could sue on behalf of customers affected by an open FTP server because it's an "Attractive Nuisance" on the Internet. Affecting a company's bottom-line is about the only way to get some to take notice.