A competent government would set up best practice rules, and tools to improve systems. They could even provide some sort of system for consumers to report these issues. Then they could assign companies a cyber security score. Basically, a wall of shame for this stuff, ideally with the option for fines for non-compliance.

Unfortunately, "competent government" seems to be an oxymoron in most places.

Edit: to be clear, I provided examples of half-hearted implementations of what I'm talking about from a couple sources, but I'm making no claims about the competency of those governments.