> There is no capitalist incentive for the latter

This is literally the point of data breach laws like this. To provide a financial incentive to take this stuff seriously.