I guess that's just how it works in present day capitalism though there might be a gap for some new laws and court system that could assess damage to the public and fine the directors something based on a guess of their responsibility even if you can't really prove who's fault things were. I doubt the odd injustice of someone not quite guilty losing a chunk of their assets would worry people that much. Like in this case you could fine the ceo say $90m even if he only has part responsibility for the breach.