Neither governments nor the market adequately punish data breaches, so why expend resources in proactively preventing them when you can just let them happen and

Neither governments nor the market adequately punish data breaches, so why expend resources in proactively preventing them when you can just let them happen and pay the (very unlikely) penalty which will be much lower than the cost of proper security?