I could consider things like catching on fire or assisting a crime (DDoS, botnet, etc) to be such cases where they absolutely should be on the hook to be requir

I could consider things like catching on fire or assisting a crime (DDoS, botnet, etc) to be such cases where they absolutely should be on the hook to be required to fix. And we already have a system put in place to assess. It's called CVEs. If you exist, you should be on the hook to fix. It's called 'Being Responsible'. And corporations have a strong tendency to not want to be. That's why we need the 'stick'.