It is different perspectives on the same thing I guess. On a global statistical level it is risk = impact x likelihood . On a local level your controls need to be appropriate for the risk. If accepting those risks globally goes without a consequence and companies accept a huge risk appetite, it is time for law enforcement and policy making to correct this in the interest of third parties impacted.