This feels like a really odd way to incentivize data breaches and/or not reporting data breaches.

Um, I think it does the opposite of what you are suggesting - this aims to reduce data breaches and incentivize people to prevent these breaches.