I'd say instead that we value the commons and don't like companies making money by externalising all their problems to the general public.

If company Foo leaks my personal data, I suffer, they don't, so without regulation there's no reason for them to invest in protecting it. Same with pollution and similar