You do realize that you can't go 2 days in modern world without hearing about a giant sensitive dataset being exposed. So yes, more sunlight is needed for any chance of meaningful change These companies can choose to staff up and prioritize sarety, because they don't do that now obviously. They don't give a shit and it shows. And they don't really have to as long as well meaning folks politely do that work for them free of charge - not the IT work, the PR work of sweeping their misdeeds under the rug.