They should pay. And then the CrowdStrike and their shareholders should pay to them. We really should just simply remove corporate veil. Make the shareholders at least pay monetarily if not in prison time.
Who's gonna rock that boat?
People are now literally invested in in a system that tolerates, if not ofttimes rewards, bad behavior from companies all the way from small things right up to "deliberately poisoning/cooking the whole ecosystem to make a buck"
I am a shareholder in dozens of companies. I have zero oversight on how things are managed. The only thing I can do is sell my paltry amount of shares if I think things are not going well there.
Shareholders would be punished in this case in the sense that crippling fines and reparations that Crowdstrike should definitely be liable to pay would decimate the stock value.
And if criminal charges were to be pressed, then the people actually in charge of the company should be on the hook. For example, if someone dies because CS was horribly negligent in their duties, then that should be a possibility.