... Hence my unease with the way the question is phrased. I'm not saying we should either mandate corporate espionage or enforce some kind of punishments for not publicizing designs, but my point is it doesn't take a lot of reframing of the question to completely change the numbers, and that makes the numbers suspect for being anything real.
It's akin to the sleight of mind that allowed us to put the burden of fraud on consumers with the concept of "identity theft," instead of asking why it should be the responsibility of the person who's information was used that some third party used that information to trick a company into giving away resources. What if the mindset were instead "it's not Alice in Topeka's responsibility that Visa allowed Bob Hacker to scam Walmart out of a bunch of free stuff by pretending to be Alice, and Alice should be required to do exactly nothing to fix Walmart and Visa's problem?" What if instead of having to contract credit monitoring agencies to look out for identity theft, the government held credit reporting agencies responsible with statutory damages for defamation when they incorrectly declare a person has done something they have not?
A slight reframing of the problem completely changes the proposed solutions and the value calculus of what was gained and what was lost.