Nothing to do with legal responsibility and it's not about only consumers.

I have 50 terabytes of data breaches on a NAS with lots of plain text or badly encrypted passwords, and that's just a small subset of what's out there.