I do agree with your point. However, I feel like regulations & norms tends to work over time. If security became a mandatory thing, single actors will of cours

I do agree with your point. However, I feel like regulations & norms tends to work over time. If security became a mandatory thing, single actors will of course be slow to invest, but the industry by itself will adapt by easing the adaptation to regulation. For example, in fire safety, it’s now harder to build a non fireproof building because nobody will build that since building technics are now fully integrating this issue. Your local web agency may not do a lot more effort to backup its data due to regulation, but you can imagine that its hosting provider would be able to provide a cheap and friendly backup solution thanks to this becoming mandatory. It’s just my thoughts.