Preet Bharara, former US attorney for the Southern District of NY, discussed this on his podcast recently.

He basically pointed out that there wasn't evidence to support the notion that individuals had the intention of committing a crime, which is what prosecutors need. It's aggravating because I see similarities in other ways that the law falls short (Equifax, Sony, etc.)

Acting stupidly or neglectfully in these scenarios just doesn't seem to have consequences beyond the damage of data exposure, market collapse, etc. as long as you can argue that you weren't aware that you were doing anything wrong.

So how do we properly deal with people that don't willingly commit crime but are so bad at what they do that the damage can be catastrophic?