At least for your last point... ideally never.

Look, I understand the intent you have, and I also understand the frustration at the lack of care with which many companies have acted with regards to personal data. I get it, I'm also frustrated.

But (it's a big but)...

Your suggestion is that we hold people legally responsible and culpable for losing a confrontation against another motivated, capable, and malicious party.

That's... a seriously, seriously, different standard than holding someone responsible for something like not following best practices, or good policy.

It's the equivalent of killing your general when he loses a battle.

And the problem is that sometimes even good generals lose battles, not because they weren't making an honest effort to win, or being careless, but because they were simply outmatched.

So to be really, really blunt - your proposal basically says that any software company should be legally responsible for not being able to match the resources of a nation-state that might want to compromise their data. That's not good policy, period.