I'm sorry, given that nothing reasonably close to this has happened already even though it should have, what makes you think it will now?

Not sure what you're getting at. We already have a bunch of laws and regulations. And misreporting your cybersecurity is already securities fraud! https://www.sec.gov/newsroom/press-releases/2023-227