Because companies are largely still operated by humans, who make mistakes. There's a difference between "oops" and "let's systematically abuse this system for our benefit". Granted, I think there should still be a penalty for "oops" moments, just not as bad. The penalty should exponentially increase with the frequency of false positives.