> Criminal law isn't about making things alright for the victim

Restitution and retribution are the components of justice [1] entirely about "making things alright for the victim."

[1] https://www.unodc.org/e4j/en/crime-prevention-criminal-justi...

The company is not the victim here. Its users are. [I suppose my previous comment was a bit ambigious - i meant something bad happens to someone else not to yourself]

A better version of your analogy would be if your landlord failed to repair your front door in a reasonable period of time and as a result soneone walked in and stole your stuff. Yes the theif is the primary responsible party, but the landlords negligence in maintaining the property probably also exposes them to some liability.

P.s. This is neither here nor there, but restitution is a part of criminal law.