Consumers already pay a huge cost. They just don't pay it up front -- they pay it later after the breach. And worse, the people who pay in many cases are people

Consumers already pay a huge cost. They just don't pay it up front -- they pay it later after the breach. And worse, the people who pay in many cases are people who were victims of the breached entity, but not customers of it (see Equifax, whose customers are other businesses, not the people whose data they gathered). Pricing this into the service from the beginning might well cause disruption to a number of industries, but that isn't automatically a bad thing. And "innovation" that consists of involuntarily inflicting risk and suffering and ruin on third parties is perhaps not the kind of "innovation" we need -- one might just as easily argue that laws against involuntary human medical experimentation "hamper innovation".