You forgot your $3 payout from the class action lawsuit when the company STILL gets hacked and the exec bonus pool increases because the settlement wasn't "that" bad.
$3 payout? You're being generous, last time there was a major breach, I believe Equifax gifted the victims a year of "free subscription" for their service.
The CRAs compete for the opportunity to offer "a year free credit protection" (that a breached company pays for), because to get it, you usually have to provide a credit card and subscribe to the highest tier. You get your free year and then they turn you into a paying member unless you remember to cancel.
Accountability is nonexistent in our industry.