[Gracana]

> The loss of customers and reputation should a major security concern arise

The potentially nice thing about regulation is that you can have some level of trust in a compliant manufacturer. In your example, customers don't know anything about the security of their chosen vendor until a breach happens.. At which point, presumably they leave that manufacturer (and they fix their shit or die), and go to a new manufacturer who hasn't had a breach yet, or has used PR expertise to hide their mishaps, or... maybe they are actually secure. But who knows? Customers don't have the details they need to do anything but hop about randomly between manufacturers.