No problem with the concept, only the execution. If you can't secure the data, you don't get the data (by law). That simple.

This is Econ 101 (incentives matter). If you do not penalize negative behavior, there is no reason for it not to continue.

Those security vulnerability notifications should've gone into a tool to be actioned by a team (JIRA, PagerDuty, whatever) with follow up and verification (audit logs from their CICD pipeline confirming a patched version had been deployed to all environments dev through prod); that's an organizational and leadership failure, which should have consequences.

Disclaimer: I work in the financial services industry in security, but not CRAs.

EDIT: Agree with your assessment edit, its a total failure of risk management within the org. Again, you need dire consequences when that occurs.

I think someone else commenting on this story correctly noted that penalties create a reverse incentive for disclosure, and there could be negative externalities in that incentive structure (to riff on the Econ 101 them). Since you are in the field, have you heard if it was confirmed vector of CVE-2017-5638? I have heard so little confirmation/attribution here... it's really hard to attribute how much was negligence without knowing how long the attackers were present, how many systems were compromised. I added a comment (I think) before your reply that generally agrees that this had to be a systemic failure on several levels. I still struggle with the fact that on some level Equifax were the victims of a criminal action, though.

EDIT: hoping to do this quickly to avoid comment/edit race conditions, but I wish I knew the right answer in re. penalties. Think about the system that exists with doctors, malpractice insurance industry, medical liability, review boards and the benefits society gets from transparent disclosure from reviews of medical errors. Honestly, short of jailing people, it's hard to see how criminal liability in this case could be worse than potential civil liability.