Bit of both. Hard to say "they didn't do enough" when its clear that they have enabled all of their client's evil activities via their loosy goosy ruleset

i.e. choosing to not do enough to enable more revenue is worse than the potential remedy by saying "sorry, we didn't do enough" and should be penalized as such