The same principle could maybe be applied here?
(Usual disclaimer I am not a lawyer etc)
In this case some sort of statutory deterrent would probably be a much more effective solution. I honestly doubt that regulation is a good solution here though - bugs like this are so severe from a PR perspective that there's already a huge incentive to avoid them.
(This reminds me of that time that Steam on Linux ate every last user file on the system whole. https://github.com/valvesoftware/steam-for-linux/issues/3671)
Microsoft paid "low six figures" for Bliss (the Windows XP desktop background) but only $300 ($45 to the photographer) for Autumn (a different desktop background)[1].
If you get physically injured and you successfully sue how do they determine the damages to award you? There isn't a dollar amount for physical pain. They can't test an alternate future where you aren't injured and see how much money you make. They just make up estimates. It would be the same here; they would estimate the monetary and emotional damage of losing the pictures.
[1] https://petapixel.com/2017/12/23/microsoft-xp-bliss-photog-p...
That has never stopped those other knights of IP theft, the RIAA and MPAA
The analogous organisations don't tend to try that kind of stunt here in the UK. Unless the copyright infringement is criminal, in a civil action our legal system currently only provides for actual damages to be awarded, and it's usual for the winning party to be awarded their legal fees at the loser's expense.
So unless there are some kind of statutory/punitive damages available for each lost photo in a case like this, it doesn't seem to be a comparable situation.
I support the principle that having permission to install updates should not grant carte blanche to have those updates do anything no matter how harmful, and indeed I would be in favour of much stronger regulation of technology in this area. However, I'm not sure how much that would help if there isn't some mechanism for regulators to assess statutory/punitive damages in some form. Even then, there's no way for a regulator to fairly allocate any financial compensation available to users who were, or claim to have been, affected. We're effectively trying to create a deterrent rather than trying to compensate for actual losses here, and with something like lost personal work, you can never make good the damage just with money anyway.