Political, social, and legal options focus on a different problem, he calls that out a paragraph or two later.

> Risk management is not just about cybersecurity, corporate responsibility or regulation, although those matter too.

What you're getting at is more about who to hold accountable and how to do it. While that may be important, its only an after the action response and won't stop future hacks or similar from happening.