If a company is large and low margin and does not care about security and they write in big bold print that they provide exactly zero guarantees about security

If a company is large and low margin and does not care about security and they write in big bold print that they provide exactly zero guarantees about security and it is your problem if something happens and they never insinuate that there is any appreciable security, then I do not see the problem with that. The customer has been informed in no uncertain terms what they are getting and can make the cost-benefit analysis themselves. Obviously, there are complexities with regard to what exactly constitutes proper notice such that the customer can do a proper cost-benefit analysis, but the spirit of such a rule is clear. This is would be different than the current state of affairs because lying or overstating your security story would have direct, pre-committed, quantitative downside. This is contrast to the outcomes of a lawsuit which are expensive, highly variable, generally require proof of intent, and depend on demonstrating actual quantitative damages.