I think this is more because we also are quick to shame what are more clear unintentional mistakes or not give positive rewards to good actors. I'm also not unconvinced there are people that want to up-play any controversy (not as any specifically collective and directed force, but an emergent behavior may look that way. More "never let a tragedy go to waste" thing).

But that's different than shaming. That's over-saturating the system with false positives. To combat this I'd encourage you to not respond, in __any__ way to bullshit fake controversy and to also give positive reinforcement for when companies do something good.

I'll give an example, you've probably seen companies like Meta occasionally do something good. For example, they released the source of LLaMA. But people tend to use those opportunities to not congratulate Meta for doing the good thing but rather complain about other bad things they do. Then yes, it fits your model, because you've reached bad steady state and you can no longer turn good because nothing you do that is good will get any signal to continue in that direction.

Us humans are weird and routinely shoot ourselves in the foot only to ask who fired the bullet, smoking gun in hand.

This is absolutely true at the scope of personal relationships. Not at all when it comes to companies, which have a different set of incentives

Using plain text passwords goes well beyond a simple “mistake” in my book. It is negligent.