You wrote a long diatribe I admit I didnt read but the first paragraph, but just to say this: this is not profitable because competitors dont do it. If competitors have to do it because no insurance, suddenly the cycle starts and everyone starts doing it.

It s a risk assessment, as we pile crap on top of crap in deeper and deeper systems, security holes grow more numerous to a point it will be profitable to cover them better than the competition.