As long as poor security is cheaper than effective security, nothing changes. Equifax, Solarwinds, and Colonial Pipeline are all still in business.
What we need is regulation regarding putting personal data at risk to provide a financial incentive for companies to take security seriously.
If you do an in-depth read of the PCI security standards, you’ll see that the standards are about protecting the card brands, not you.
Risk is free.
A risk-aware competitor faces a higher cost function and a market which won't support it.
What we need is regulation, and direct liability of corporations, stockholders, creditors, and executives.