Excellent comment and the current business structures have made it even worse: If the security incident is actually really terrible, simply fold the publicly-f

Excellent comment and the current business structures have made it even worse: If the security incident is actually really terrible, simply fold the publicly-facing company and pivot with all the IP in the IP company. Maybe white-label it, or maybe just wait a little and start the exact same type of company under a new brand. Only the papers get a slap on the wrist.