I think fining manufactures would lead to scenarios where we fight the last war, much like how the 2008 financial crisis was not prevented by the existing nest

I think fining manufactures would lead to scenarios where we fight the last war, much like how the 2008 financial crisis was not prevented by the existing nest of regulations which were passed to prevent the previous crises. That is fining manufacturers would lead to strict and expensive regulations saying just how things must be done, but which are laughed at by baddies developing new exploits that work within these particular rules. On the other hand, if the rule is "if your box does bad stuff, then you must pay" -- then consumers will look to security as part of the good reputation of the vendor. That extra layer of indirection is what I look for to avoid "last war" type scenarios.