The easiest way to come up with rules where no compromised entity is found in compliance is to make the rules impossible (or wildly impractical) for anyone to c

The easiest way to come up with rules where no compromised entity is found in compliance is to make the rules impossible (or wildly impractical) for anyone to comply with. If it were a matter of "we 100% know lots of companies that haven't had breaches fully comply with the rules", it would be a relevant data point. If we don't know that, we can just assume that the rules—much like our legal code—are written in a way where a motivated auditor can always find non-compliance. "Give me six lines written by the most honorable of men, and I will find an excuse in them to hang him." and all that...