What if the data leak was out of their control, aka should researchers be liable to field advanced, expensive security teams to protect against the liability of this suggested regulation.

I 100% agree with your sentiment, but I think the answer is incredibly complex.