I don't believe you. Give me an example of a company spending 100's of millions as a result of a breach. Companies understand it costs them nothing and if there is a cost it's trivial. When there is no penalty or the fine is a pittance, no company is going to spend 10's to 100's of millions. It makes no business sense first of all and secondly they can blame a foreign actor to mask their own incompetence.