If you were responsible for securing my stuff, and you put a cheap lock on your door protecting my stuff, and someone breaks in and steals all my stuff, then yes, you should be held liable for your poor security practices.
My only concern is what happened with Equifax - some punishment is put on the company and it's only a token amount and nothing changes.