Maybe if the exploit is actually leveraged to cause damages. Outside of that, you think they should get fined because the possibility for exploit is there?

Edit: missing clarity - I think fines are appropriate when/if damage occurs, my reply was based on if notification happens without actively being exploited.