There already are consequences. Auditors will check the physical security of your office buildings if you're dealing with anything sensitive. If a breach happens later on and it turns out you cut corners on that physical security (or even somehow unwittingly compromised it) then you're not going to have a good time.