Thank you for the question.
I think that the issue isn't so much the misalignment but the lack of any perceived real risk of a fee or a penalty. Fees are charged for the failure to disclose a leak of important information. However, there must also be a perceived real risk of a penalty. This is missing here.
In some cases, the risk of having to pay fees is considered the cost of doing business. In my opinion, this isn't a sound or even ethical approach to risk management. The regulatory bodies currently lack teeth. This may be the issue.