> They are the ones who should bear the burden of mopping up their mistake.
This is true to a large extent but having worked in resolving "identity theft" I can say that it is complex.
In a place like the UK the requirements for a bank loan are pretty stringent but here in Australia they are much much lower and people hate friction. Authentication is a hard problem. Knowing someone's creditworthiness is a hard problem. There are a also many of people out there who are willing to claim "identity theft" has occurred to mean that it is complicated.
Most of the time for people whose identities had been stolen it was fairly easy to remove based on the most cursory evidence (which often I only had access to because I had access to air gapped data that was kept for far longer than the 7 years it was meant to be kept).
The status quo exists because it inconveniences just few enough people and is an acceptable amount of risk to the powerful. One side of politics will denounce anything that looks after the interest of both these groups as too much "red tape" and the other will denounce it as "discriminatory".
For comparison I look to the family violence measures we introduced here in the last decade. It was a battle which took years of firmly but politely refuting the opposing ideas "family violence victims should never have to justify themselves to a credit provider" against "credit providers should never increase their risk without having charged more up front".
A compromise model was found where the credit providers effectively pay for the losses but in reality they just charge it back to their customers. Right now paying for identity theft is a lottery. In future it's going to be internalised up front. This will be good for the victims but for the rest of us its an increased cost.