I'm not sure that framing makes a lot of sense here. This was a SaaS product for process automation which seems like a perfectly reasonable product. I would argue in fact that having tech companies (meaning companies which have specific expertise in building software products as opposed to companies that have a expertise in something else and also have an "IT department" bolted on) manage sensitive data is likely to make it more secure rather than less. Companies and other institutions which don't have any particular expertise in software engineering and security aren't likely to do a good job. Of course when those companies do screw up they should be held liable though, up to an including criminal liability is the leak is bad enough and the exploited vulnerability is egregious enough.