It does make sense. You're confusing corporate liability with personal liability. The parent's point is that if the investors / shareholders would be responsible. Stuff like this would be severely reduced because resources would be allocated to prevent it. Right now, the only damage is a financial one. And as long as the damage is lower than the cost of prevention, hacks like this will continue to happen.