1. The re-framing by financial institutions of them being defrauded as "identity theft" and pushing this responsibility onto their customers.
2. Because of the above, the data can be valuable, incentivizing the compromise.
Re 1: Note that credit card companies have had this problem for ages and treated it as fraud for decades, which is why established card companies can have very reasonable processes to cancel transactions, mark some as fraudulent, and probably why they have reversible transactions. However, because of the rest of the industry card companies now appear to be jumping on board with the "identity theft" concept.
By collectively not treating it seriously and essentially letting it happen and inconveniencing their customers instead of the vendors, banks have essentially washed their hands of it and give zero incentives to the vendors to seriously try to protect the data. If every transaction marked fraudulent meant the vendor didn't get the money, there would be a lot more serious action here.