I am not sure the analogy is very accurate. You do not advertise your house as a place where other people can come and freely store their valuables and then tak

I am not sure the analogy is very accurate. You do not advertise your house as a place where other people can come and freely store their valuables and then take it out as they please. If you did, there is a name for what you have built: a bank. And you can be pretty sure people then will not have any issues with whatever security measures you take. Most of all, your cost of security installation is now covered by other people's money, which effectively gives you very precise calculations on what exactly you can and cannot spend. You are more than free to return the money and shut down shop if you feel you are in a completely unsafe neighborhood which makes your bank impossible to run at a profit. To stretch this point a little further, imagine you did have a bank, and your customer comes and demands to take their money out, and you say "Oops. I had just left it out here on this desk, and when I went to pee, a kid just came in and ran out with all your money. I feel bad for you, but the cost of moving the stuff back and forth between front desk and the vault would make the service unprofitable. Its not my fault, its all these children in the neighborhood who keep pranking me". The lowered barriers to hacking, combined with an ever moving target for what constitutes good security, are genuine concerns. But as a company, you are expected to shoulder the burden of security as a precondition of making the claim that you provide a good service. One way or another, people actually pay you to take care of their data as part of the service.