I agree. unless the one who stole the data comes and lays out the exact preventable vulnerability they exploited, this is just going to result in businesses pay

I agree. unless the one who stole the data comes and lays out the exact preventable vulnerability they exploited, this is just going to result in businesses paying through the roof for fake assurances of security from middlemen, indirectly passing the cost on to consumers/society.