[ergocoder]

Then, let's push for a regulation where the researchers will go to jail if there is a data leak from there.

Surely the regulation should be non-controversial since the researchers are 100% trustworthy like you mentioned.

Unless there is such protection, FB is still liable.

For FB, if the researchers turn out to be good, FB will benefit nothing. If the researchers turn out to be bad, FB will be fucked. I wouldn't want to play this game either.

[fsociety]

What if the data leak was out of their control, aka should researchers be liable to field advanced, expensive security teams to protect against the liability of this suggested regulation.

I 100% agree with your sentiment, but I think the answer is incredibly complex.