We apply crippling fines on companies and executives that let these breaches happen.

Yes, some breaches (actual hack attacks) are unavoidable, so you don't slap a fine on every breach. But the vast majority of "breaches" are pure negligence.