The problem, as always, is externalisation of costs. If they don't pay for the consequences of the risks they take (such as prioritising profits over security,

The problem, as always, is externalisation of costs. If they don't pay for the consequences of the risks they take (such as prioritising profits over security, etc) market forces demand that they take those risks. People talk about the market fixing things, but that only works if it's not possible to externalise costs. Unfortunately, the only practical way to enforce that is through government regulation. The government is also a system which seeks to externalise costs...