This is very simple: the cost of this "incident" for Equifax is zero. As a smart business decision they are not investing (enough) in security and code quality

This is very simple: the cost of this "incident" for Equifax is zero. As a smart business decision they are not investing (enough) in security and code quality because they don't need to. Now if they knew that there is a $1000 fine per each stolen identity information, then the equation will shift and it will be a much better business decision to invest into protecting user data.