On first blush, I would think this would at the very least force companies to improve their security.
Not saying that we should adopt such a system, potentially terrible idea but it amusingly is better than other "do something" legislation in that it would actually help the target problem even if there are clear downsides.