Well, maybe the US cultural status of caring about computer security in business is so decrepit that only a really major high profile incident will shift priorities. Maybe the most effective route from today's situation to a a world in which US industry takes computer security seriously involves a temporary detour through a serious major disastrous hack. Maybe it's inevitable.

It's certainly consistent with how things have gone so far. Computer security is terrible today, but it was even worse a decade ago, and it's the low hum of constant cyberattacks and ransomware that probably have helped push that.