Because apparently SEC had years ago issued an order that breaches must be disclosed if they may have a material impact on shareholders (e.g. a potential large

Because apparently SEC had years ago issued an order that breaches must be disclosed if they may have a material impact on shareholders (e.g. a potential large lawsuit from customers some years afterwards when the full extent becomes known), and it's the job of SEC to ensure that company executives don't hide company problems from the shareholders. In essence, if you want to keep your dirty laundry private, then you're not allowed to take money from the public stock market, as investors (i.e. everyone if you want to be publicly traded) deserve to know about any major issues with your private servers. SEC doesn't care about how poor your security is as long as the company is open about it, but it absolutely cares if company lies about their (lack of) exposure to its owners.