> you will face criminal and financial penalties for damages caused

Even with where we're at right now, if people involved with the HF or Ruby Gems attacks faced legal consequences, the industry would get a lot more conservative very quickly. And unlike social media, section 230 doesn't apply, and there aren't any free speech concerns.