It was a case of pay $1M and take no responsibility vs. set a budget of 40K and own it internally.
When salesforce leaks your customer's information, whoopsie! not our fault! it's salesforce!
And yet they're far more likely to have the leak. BASICALLY.
In fairness to Salesforce, it was the garbage third party apps in their ecosystem which got compromised and did the leaking, not Salesforce themselves.