Do you make it unmistakably clear for new users that if you have a data breach and someone loses $400,000 because you leaked their password, they are likely shit out of luck?

Don't know US regulations, but my country has plenty of case law determining that the customer is liable for every single dollar of loss if someone uses their account details to steal their money or take a massive loan in their name.