This SHOULD be the way as they are the ones who stand to gain the most. They should be the ones who lose the most if the actions of their responsibilities are nefarious.
But in turn it would incentivize some better practices to avoid risks of fines.. It wouldn't be risky if companies didn't act maliciously and ignore regulations etc.