On one hand, someone like a Jia Tan should be held to account in some way, if it was a nation state, there could be sanctions.

On the other hand, finding the actual malicious actor seems like a harder problem than fixing code and ensuring resilient trust chains.