Recently in Washington State, a small research group at WSU lost a couple of hard drives that had PII data on them on order of 1 M people. They even had them in a safe; the safe was stolen and no real evidence of the data being the target of the theft was found.
Nonetheless, being good civil servants they scrupulously reported what happened and carried out required notification procedures to the million folks.
Their reward was to be sued for basically the maximum that their insurance would pay out.
How many thousands of times per year do similar things happen in private industry? Nobody knows. You don't even have to posit malice or a coverup; just think about how many times a year a hard drive backup of a database with a mere million records gets accidentally thrown away or sold off with surplus.
If the liability had been $50MM or $500MM, you can bet their storage practices would reflect it (not to mention actually telling people you're collecting their data). "Eh, whaddya gonna do?" is absolutely a normalization and a devaluing well out of proportion to the damage that is done.
Furthermore, how much time do these breaches steal in lost productivity, or in diminished free time, for all of us? Quite a bit, but the only time you hear about that metric is when management is complaining about employees talking to each other in the hallway.
Protections not established early become harder to impose later, which is why the companies and lawmakers to which they donate downplay the severity of these breaches via pittances of penalties, 30min of revenues or something. Fines should be $1000 per individual exfiltrated, or a year of revenues (at last year's number), or other figure that would be actually effective...and with strict liability.