Companies will care about securing their systems and paying for these services if it costs them Real Money when they neglect to do so.

Until then, they'll continue to not care. The solution is not a legal framework presuming good samaritans will secure the networks and systems of the world.