So maybe they are doing something right.
> the threat/worry of bad publicity
Yeah , that hasn't worked for Exxon Valdez, nor for any of the recent data dump incidents.
The Underworld is now multibilion dollars business and is getting better at it's trade with every day. It is relatively safe and lucrative.
Identity theft, SIM swap, SWIFT half a bilion dollars theft in Bangladesh, South Africa - Japan credit cards. Just to name a few.
Remember that money at the end of the day is based on trust. If you cannot trust that the money on your account are safe. Or if your money is not liquid because banks have to manualy verify dubious transactions then your money are loosing value.
1 https://en.m.wikipedia.org/wiki/Bangladesh_Bank_robbery
Obligatory Mitchell and Webb "Identity Theft" link: https://www.youtube.com/watch?v=CS9ptA3Ya9E
The average IT company however doesn't care much about leaks of customer data, except perhaps for the publicity effects.