This is why GDPR has the fines up to €20m. Hopefully some of these users who were breached file for a breach, if you can't hold my data you don't deserve it. Good intentions aren't compatible with the law.
The alternative to a mens rea requirement is https://en.wikipedia.org/wiki/Strict_liability .
> When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following
> the intentional or negligent character of the infringement;
A company with good intentions is going to be regulated less severely than a company who does't care.