Their settlement ended up costing as much as a few good engineers for a year. Consequences like that will mean it makes financial sense to ignore security and just pay the settlements as they come.

Consequences should motivate companies to be secure. i.e. it should be much cheaper to hire a large competent security team who has a chunk of engineer time than it is to pay tiny settlements to teams of lawyers.

Data breaches aren't just necessary evils, they can be prevented, but not without a lot of extra work. Companies should consider a data breach to be an existential threat, not a cost of business.