The penalty for "unauthorized access to a computer system" is 1 to 20 years in prison[1]. Holding corporations accountable would include sending the highest person in the chain-of-command that caused the Hugging Face incident to jail. Or at least start with some charges and then let the judicial system do its thing.
[1] 18 U.S. Code § 1030 - Fraud and related activity in connection with computers https://www.law.cornell.edu/uscode/text/18/1030