Liability guidance is effective at being clear about who needs to pay for security. An example of where this is effective is the rollout of chip-and-pin credit cards. Only when retailers became liable for forgery due to the "weakest link" liability clause put forward by Mastercard and Visa did they become motivated to deploy card terminals that could do chip-and-pin. And fraud has been significantly reduced as a result[1].

[1]: https://usa.visa.com/visa-everywhere/blog/bdp/2019/05/28/chi...