Furthermore, how much time do these breaches steal in lost productivity, or in diminished free time, for all of us? Quite a bit, but the only time you hear about that metric is when management is complaining about employees talking to each other in the hallway.
Protections not established early become harder to impose later, which is why the companies and lawmakers to which they donate downplay the severity of these breaches via pittances of penalties, 30min of revenues or something. Fines should be $1000 per individual exfiltrated, or a year of revenues (at last year's number), or other figure that would be actually effective...and with strict liability.