Insurance companies generally try to minimize their risks. One way to do it in this case is to set security standards, to which their customers must adhere. Customers who do not do so could face lower (or no) payouts after incidents.
There are already some standards, e.g. PCI for credit card handling.