They go bankrupt, get acquired, or just hope that no one notices their security mistakes.

Admitting mistakes and correcting them directly is not a common thing for CEOs to do.