In this case they even might come in and check if you didn't take sufficient actions to prevent this bad event.

An individual will be informed how not having a lock on the door was a failure in individual responsibility to prevent harm against yourself/others.

But an operator of digital infrastructure might get audited for compliance of the critical infrastructure directive/act. In the EU fines for such violations can be as high as €10 million or 2% of global turnover.