What else would you see them do or say beyond this canned response? The reason I am asking is because people almost always bring up how dissatisfied they are with such apologies, yet I’ve never seen a good alternative that someone would be happy with. I don’t work in PR or anything, just curious if there is a better way.

Lose money accordingly - fines, penalties, recompense to victims, whatever... - so they then take the seriousness of security into account.

Not apologize if they don't actually care. An insincere apology is an insult.