Why the middle man? Can't we make the law so that the University is still liable for the data beach because it's "their" data (collected/stored on their behalf) that is breached?

I think that still aligns the incentives, and University in this case has interest to make sure the data is stored properly.

This is already the law, but the shell company signs the ownership of the data and the security responsility. The university in this case is just using APIs to load and store stuff to someone else's servers.

If this is not possible no cloud storage would ever be possible to be liable for anything. Your Google drive got hacked? Your responsibility.

Insurance only pays for damages, up to the limit of coverage. It does not do anything to remove liability.