That's a pretty weak straw man; a data breach is entirely different to a store being robbed, as you well know.

One might as well ask

> Why does anyone stay in business in CA?

since (I believe) Californian state law has similar reporting requirements (and fines/civil liability) for breaches.