Insurance should be used in addition to security best practices, not as a replacement. OP did not suggest that insurance should be outlawed, but that "just relying" on it should be a strategy that the market snuffs out. As a tech professional, it's hard to have sympathy for companies that are "hacked" via very basic exploits. I doubt Schlage would have much sympathy for a burglarized homeowner who had neglected to invest in locks.