It becomes tricky fast.

There is obviously a fine that could bankrupt the company: this would be a clear signal "do not do this".

There are also many cases where people have been doing everything they should have been, and still got hacked (zero days, for instance).

Now, I do not think people should only be slapped on the wrist in that case: it still needs to be significant so companies carefully decide to store only the data they really do need!

It will be when enough people elect enough politicians who take action against this weaponized incompetence and strip-mining of the peoples' assets.

Or, if that does not happen, when enough people rise up in revolution and take the compensation for themselves.

Or, never.

If enough people vote enough or revolt enough, they cannot be stopped. But the incentives for too few people rising up are too costly. They work hard to keep the equilibrium in that balance.