Bullshit. Liability and regulation can absolutely help with ensuring better practices. The fact that the SEC now requires disclosure of active breaches has forced companies overnight to begin taking cybersecurity seriously, and there are plenty of other liability related changes happening as we speak.

The comparison is valid, the laws work and also they don't. Using a big hammer can make things overall better but for some individuals much much worse.