I can think of lots of unpunished security failures from all of these. This is one of the very few areas in which it seems like business as usual.

Executives don’t like to punish their own people because it makes them look bad. They’ll scapegoat people when necessary of course.