To play the devil's advocate, in an ideal world, you go out of business and another business that actually followed security best practices takes over.

Over time, companies start taking security more seriously. When it affects the users, they can just ignore, business as usual. But now, they can't just go on with their days, so that's the real accountability in my opinion.