No, that's impossible. No one would want to start a business, ever if you could just be wiped out because some vendor's vendor fucked up. If you want that, then we need like a free tax funded federal MSP.
Good, the whole point is that if you aren't willing to take responsibility for the information you are storing, you shouldn't be storing it. So businesses without the will to do that will shut down, the rest will be more hardened, or less willing to stored data they don't actually need.
That’s a massive cooling factor in the biz env, it starts to have huge negative impact. Over time, the regulatory environment causes US to lose edge, declining salaries, quality of life.
Nope. You’ve clearly never worked in IT. There is no perfect solution. And the closer to perfect you get, the system becomes harder and harder to use, maintain, and modify.
If it's a vendor mistake then either the fine goes directly to them, or you sue them for it.
So who gets sued in log4j?
The companies using it didn't (generally) have a commercial relationship with the authors, so I'm comfortable leaving the users holding the responsibility. Fair question, though... I might even prefer to make liability only follow services, not code. So if you make a SaaS that takes PII, that's you're problem. If you publish code that can hold PII, that's still the problem of whoever uses it on PII.