OK, so there are criminal and civil liabilities for pwning corporate websites. But it's OK for corporate websites to pwn user devices. Because there's a $5K damages threshold for CFAA, and also a damages threshold for tort class representatives.

That's arguably a huge bug in the legal system. Maybe there's a niche for private compensation services. Anonymously crowd-funded. Somali model.