If developers would have to be licensed to work with sensitive user data, and the penalty for leaking it would be losing your license, penalties and being unhireable for IT work, there would be a lot more incentives for people to be more careful. Have any of the developers who implemented the systems that leaked data faced any consequences as a disincentive for it not to happen again? It would incentive developers to care more about security, not just say "eh, it happens, and it doesn't affect me, so who cares".

For user "spying", the code of ethics could contain something like "respecting the user" (idk, just spitballing) and those who want to implement more "spying" into their software could be "disbarred" for unethical behavior. This is even mentioned in the IEEE text: "Approve software only if they have a well-founded belief that it [...] does not [...] diminish privacy".

I guess you could codify this into law (i.e. GDPR style), but even that (at least to my understanding) does not hold developers individually responsible, but their company. E.g. when google gets fined, the developers who created the code are less likely to think "this is bad, therefore I will restrain for doing such things in the future" and more "how close to breaking the law can I push without the company getting in trouble".

Pray-tell, what will?