Not that I disagree but it also incentives attackers to steal and resell data to other nefarious actors.

After all a lot of the data companies have isn't their own, it's their customers. They are the ones who suffer because businesses don't bother securing their crap.