So where’s the line drawn? How much should taxpayers be primarily responsible for if a private company doesn’t meet established security standards?

The comments in this thread you’ve joined seem to imply a private company should be held to no standards, and that this specific company’s security should primarily be the responsibility of other taxpayers.