The data breach insurance I'm aware of does have such requirements, but cybersec standards change so rapidly, and it costs so much to do any decent inspection, that in practice it just doesn't work as well. It's not like a building where fire codes are more or less the same from year to year, and where a fire inspection can be done in less than a week (if not a single afternoon).

Most organizations I've seen have a very complicated risk management formula to determine how much they're willing to spend on things like cybersecurity. I simplified it my original comment, but from what I've seen in the current state of things, insurance is typically on the side of the equation that justifies spending less on security, not more.