Eh, companies would probably be permitted to keep using the systems since "it's the industry standard, there's nothing more we could've done", and it would just become another instance of regulatory capture.

See, e.g., the GDPR, which as written has strong language against storing data, but as applied is riddled with 'reasonable' exceptions that have never been tested in court. It's like Schrödinger's regulation, it's both incredibly restrictive and trivial to comply with (unless you're Super Evil™) at the same time, somehow.