The problem wasn't that they had bad security and were hacked. The problem is that they lied to investors about their security and about the hack. So if a CISO

The problem wasn't that they had bad security and were hacked. The problem is that they lied to investors about their security and about the hack. So if a CISO was the one telling the lies (and you seem to acknowledge that their main purpose is talking to clients, but maybe its also talking to investors) then they seem to be the right person to charge even if they weren't responsible for the bad security.