Didn't we as an industry collectively shrug at closed source code (which could be doing anything with our client's data). Then we shrugged again when we took a

Didn't we as an industry collectively shrug at closed source code (which could be doing anything with our client's data). Then we shrugged again when we took all our client's data off-prem and onto the cloud. Then GDPR hit some of us, so we just sorta declared the cloud-providers to be GDPR-compliant and called it a day. What's gonna be different about this (justifiable) outrage?