But why would that be an appropriate amount? By having the fine around the lowest possible investment to tackle the issue, you're literally incentivizing compan

But why would that be an appropriate amount? By having the fine around the lowest possible investment to tackle the issue, you're literally incentivizing companies not to take security seriously. After all, you can save money early into development, and just fix it whenever you have time - you'll still save money compared to doing things right immediately. So again, why would this make sense?