The trouble is, in the absence of prior action, some people or organisations cause harm that can be undone, but some cause harm that cannot be undone and for which mere financial compensation is insufficient. The question is which is more damaging, a harm that cannot be undone or the consequences of preemptive regulation to prevent that harm from occurring.

Individual possession of weapons is a crude but effective example. In some jurisdictions, individual citizens are free to carry personal firearms. In some jurisdictions, they are not. There is a political difference of opinion on whether the damage caused by irresponsible individuals abusing that freedom is outweighed by the benefits. However, I know of no jurisdiction where an individual citizen may lawfully carry around a nuclear weapon that would allow them to unilaterally destroy an entire city. The consequences of abuse are just too severe.

In all such matters, there will be grey areas, but it seems very clear from the state of the world today that commercial incentives do not automatically coincide with guaranteeing the continued provision of essential services in the face of attacks that are relatively unlikely but would cause vast disruption if carried out successfully.