Companies should be liable for negligence depending on the kind of hack. If they were hacked through use of an old package - defined by regulations - then they should be liable.

If it was a zero-day or something newer - defined by regulations - then the company is not liable.

Your analogies are cute but I want new laws, further making your analogies moot.