Insurance also creates a moral hazard regarding proper cybersecurity. A risk/reward analysis may arrive to the conclusion that upgrading infrastructure and hiring/training staff will be more expensive than simply paying more for insurance.
Similar to how house insurance will ask if all entries have locks and the structure is sound/secure. If they prove it was left open - you're not getting your payout.