If you start mandating companies do proper authentication, then you kinda need proper authentication to be possible. Really, the way to do that is through a government-issued ID, but the US does not like that idea.

Without government-issued ID as a base, doing authentication right is difficult. Especially account recovery simply becomes a mess. Having high fines might cause certain users to be permanently locked out 'because we cannot properly authenticate you'. It would light a nice fire under efforts to properly handle authentication, but that fire would burn a lot of people first.