I think the answer is risk tolerance related for how much they would be sued without the testing. Many companies do risk analysis above and beyond what the minimal regulatory requirement if they feel it is more cost effective. That would be the number used in comparison.
That said the regulatory premium may still be the right thing to do given horrifying human costs and potential to leave everybody else holding the bag when they go bankrupt with expenses far beyond what they can pay. Even if you seize assets of the entire board in a criminal proceeding it is still possible to do more harm that can be repaired by the courts and thus make regulation the rational thing to do in addition to the right thing for a circumstance. Or the regulations could do more harm than good. In general regulations themselves aren't inherently good or evil but circumstantial.
That said the regulatory premium may still be the right thing to do given horrifying human costs and potential to leave everybody else holding the bag when they go bankrupt with expenses far beyond what they can pay. Even if you seize assets of the entire board in a criminal proceeding it is still possible to do more harm that can be repaired by the courts and thus make regulation the rational thing to do in addition to the right thing for a circumstance. Or the regulations could do more harm than good. In general regulations themselves aren't inherently good or evil but circumstantial.