As long as the costs (monetary and otherwise) of breaches are not (by and large) hitting shareholders and the C level, why would they pay for better security? And why would politicians depending on campaign contributions of tech companies force the mentioned groups to take on the full responsibility by regulating them?