That‘s because these companies, and the regulation itself don‘t have security in mind. It‘s really only about compliance and liability avoidance.

There is no incentive for change. Look what happened with Equifax.