Until these businesses (small and large) become responsible, either legally or financially, for the security of their websites, we'll see this continue to happen.

They simply don't care about the security of their customers because they have no incentive to.

I get that security is hard, but in this specific case, they knew about a hole and left it open for two months. That's negligence.