That sounds great(-ish) when the company in question is one like SolarWinds that does hundreds of millions in revenue, but people and companies are equally reliant on open source software or software from tiny businesses. Trying to fine random Github users or the Linux foundation or whoever seems like a losing strategy.

It also ignores the point from the article that the solution can't be trying to make all software secure. Whatever the incentive mechanism and whatever the source of the insecurity, it's unrealistic to think we're ever going to be able to make that a reality. But designing the environments software is used in such that broken software isn't the end of the world seems doable, if also incredibly difficult.

The inconvenient truth is that people say they want more, better security but they don't want to pay for it. So to survive you need "just enough" security to get by, and that "just enough" turns out to be quite low. It's also not clear if a significantly better proactive security is necessarily better - humanity is still collectively figuring out how to balance the security/privacy vs the convenience, and we do risk fossilized information technology stacks if we jump on the security too hard.

That said, it's often easy things that get the most benefit and we are collectively a long way away from getting the basic security things done properly across the board.

That probably costs us as a society more man hours than it saves.

Particularly in reduced competition due to deep pockets being required to even play the game.

How do you differentiate between honest to goodness mistakes and a willful/malicious attitude toward just getting (product) done to make money at all costs?

It seems like a fine structure would have to take that into account? Or am I way off base?

It also entrenches the Big Tech. Because what FAANG and big banks can pay, no startup or small company can afford.

On the other hand, a quality needs fines. Otherwise, it's too easy to "forget" an inconvenient quality to make a short-term profit (and sometimes compromise users data).