The worst punishment any company receives for bribing, stealing from, defrauding, or poisoning the public is a slap on the wrist that is outweighed by the profit they make committing crimes. We need to be comfortable with devastating corporate punishments (company-destroying fines, mandatory company breakups, nationalization, jailtime for executives, asset seizure) to have any effect at all. What did we learn from Equifax? Don't worry about the security of people's data, there is basically zero real consequence to posting sensitive data on every citizen in plaintext on the Internet. Money spent on security is a waste, an objectively bad business decision. That's what our government and regulatory bodies have told us. And it's what the market has told us as well, but we already expected that -- we expect the market to choose evil when given the choice, every time. That is its function.
Right now, a CEO cannot say to their board "Yes, the cost/benefit analysis and market forces suggest we should bribe the city officials and steal money from the taxpayers, but we'd go to jail so we can't" because it is not true. All they can say is "it is morally wrong" which does nothing except get that uppity CEO fired so somebody who really cares about profits can be brought on.