> I read an analogy that pinning this on "cyber security" is like accusing a mugging victim of having a lack of personal security guards. That's just not how civil society works

Civil society does punish businesses when bad things happen due to negligence. Especially when the result of the negligence negatively effects someone else.