In practice this insurance (which already exists!) just creates another compliance checklist and not a meaningful focus on actual security.
Obviously, the incompetent insurance company will entrench itself by lobbying for laws / making it harder for other companies to compete / get bailed out by a state or country when they fail.