> The first time "something" happens (at least if you buy the argument) would be bad enough for legal punishment not to matter.

One could argue that the "HuggingFace incident" is already "something" which should be investigated and punished very heavily.

It's kinda ridiculous to build a machine that attacks a competitor of yours and the CEO gets to write blog-posts on how fascinating this machine is