Right now if data leaks, maybe you get some emails and user data which is cool but ultimately useless beyond spam value or for identity fraud, or perhaps for hacking some other financial accounts that may be of some value, but also adds more risk.
But if you know a company could be utterly destroyed with fines, you can open up a huge short position on the company and then publicize the breach somewhere and wait for the stock to drop to zero.
Or maybe you’re a startup and want to eliminate some competitors. Pay off some hackers in bitcoin to attack and breach their servers and watch them go under.
Better to just leave things the way they are now.