Against oil spills? Yeah, the .com I work for will not cause an oil spill.

Data security, that's a different manner. Yes, companies should be secure if they claim to be, especially if they store data about their customers. Litigation and bad press, in these cases, seem to cover things well, since there tends to be more competition in the .com space. Fortunately most .com's do not need to keep sensitive information. Some do however. Sucks for them.

In the case of a player in an oligopoly for a critical industry (Energy), it's a bit different. In safety-critical industries, there is strong regulation. Why not in industries which can wreak severe environmental havoc?

The environmental damage BP caused may be worth more than the company itself. Like Exxon, I don't see them having to pay the full cost.