I think if there was a financial penalty of say 1% of profit/income for each "incident" where something was hacked/exploited, then the companies would be much more willing to think about safety.