I think the idea is to penalize companies for not taking security seriously. This is not mutually exclusive with going after the hackers. Colonial pipeline is

I think the idea is to penalize companies for not taking security seriously. This is not mutually exclusive with going after the hackers. Colonial pipeline is not normal people, and this is effectively a result of negligence on their part