They're US companies and I've heard that it requires intent according to US penal law. I find the article's claim that intent is established dubious. Since this is hard to prove without a whistleblower, it seems that they only have to fear civil lawsuits, and given that we speak of trillion+ USD companies they might feel confident to be able to fend these off or simply pay out the victims in settlements.