Good IT and engineering staff is a lot more expensive than even a fine for 10% of your annual revenue. Hiring a single good security engineer might cost 400k or more.
Good luck getting your insurance company that pays $100k to senior engineers to do that.