Sure, in the case of ransomware, phishing the ceo, etc. you are right. But for most other cases that AI would affect, it's not like companies would care if there weren't regulatory consequences forcing them to.