Wouldn't the incentive be to not have to take on the liability for it? Then again, if all a major breach results in a slap on the wrist, then I guess there's no real liability. Maybe you're right.