>most of what police do is after the fact.

This. Police are just the clean-up crew who come 20 minutes after, and fill in the paperwork proving that something bad did indeed happen to you, that you can then use for your lawsuit or insurance claim, nothing more.

Unless you're a politician or the billionaire owner of an island, they're not gonna do much more to actually prevent or solve your problem.

In this case they even might come in and check if you didn't take sufficient actions to prevent this bad event.

An individual will be informed how not having a lock on the door was a failure in individual responsibility to prevent harm against yourself/others.

But an operator of digital infrastructure might get audited for compliance of the critical infrastructure directive/act. In the EU fines for such violations can be as high as €10 million or 2% of global turnover.