That is only a problem if you create mandatory fixed-cost liability requirements. You can solve the problem by allowing companies to opt-in to liability requirements for some benefit. As an example, we could require that any company that wants to advertise security must do so in the form of a number specifying how much they will pay their customers in the event of a breach. So, they would not be able to advertise something like: "We have a secure cloud database.". They would instead be required to say: "We have a cloud database with $10M security." and in the event of a breach be forced to pay out $10M to its customers.

So, if a company is small and unable to afford any security, they can just set the number at $0 which means it is the customer's problem. However, if the company is big and people have security expectations, they would need to specify a reasonable number that would alleviate those concerns. As long as the number is clearly communicated and you are not allowed to fraudulently or misleadingly advertise a different number, then customer's would be able to make an informed decision with respect to the security level and liability they are accepting from their vendors.

Obviously there are some complexities with respect to properly communicating this information. For instance, for a consumer-facing company you would probably want a per-consumer number instead of an aggregate number. As an example, if Apple were to claim $300M for the iPhone, that might seem like a large number to an average person, but that would only amount to ~$1.50 per iPhone sold in a year. You also need to prevent misleading advertising that might attempt to divert from the quantitative liability they are actually accepting. However, the base scheme of mandatory labelling requirements along with opt-in liability should allow for a solution that is hard to bypass while being flexible enough to support both small and large businesses.