Who doesn't have an incentive to mug someone on the street? So, what stops them? Morality. Law. Responsibility. Reputation.

All of this applies to companies. Morality comes from shared culture and values. Laws like GDPR help. Reputation is a huge one; if companies want any sort of meaningful enterprise contracts, especially with PII/PHI, data privacy and security is paramount.