They need to face consequence of their in-actions not because they got hacked. If you did follow good practices and still got hacked by an zero day it is one th

They need to face consequence of their in-actions not because they got hacked. If you did follow good practices and still got hacked by an zero day it is one thing and your point is valid, however when you hacked because of gross negligence and effectively kept your doors open it is something else and that should be punished ?