I'm not calling for regulation on general security outcomes. I'm talking specifically about access controls on sensitive and highly privileged systems that have ripple impacts to consumer security, which should already be obvious best practice.
There is obvious, direct, and destructive customer impact here.
Edit: actually I know people working in security roles for T-Mobile, and I am sure they or their sister teams are trying.