> yes it's a security issue but you wouldn't "expect" to get fined millions of dollars.

Which is exactly why companies don't care, which is why this regulation was made and those fines decided.

> Usually in software engineering you don't get your company fined for making terrible mistakes unless you're in a field like finance.

You're not fined for a mistake, you're fined for a mistake AND that mistake huer the customer more than you AND you don't disclose it swiflty to him.