One thing here is that sensitive data getting stolen does not necessarily mean that the data controller was negligent with their safeguarding. There definitely

One thing here is that sensitive data getting stolen does not necessarily mean that the data controller was negligent with their safeguarding. There definitely are highly publicised cases that happened just because of gross negligence in handling that data. But to some extent, every system is vulnerable, and there are also attacks that are, using your gun and car analogies as an example, the equivalent of stealing the gun from your safe or taking your car at gunpoint while you're stopped at a red light.