Security consultants and contractors already exist.

But why would Panera, Equifax, et al bother investing in better security when they face no consequences for these incidents?

Markets can't solve everything

Because that would cause Panera a lot of money and the alternative (this) will likely cost them very little money. The choice then becomes clear: it's cheaper to tweet out an "oops" apology than to actually prevent it.

They don't care that your information got leaked, that doesn't enter into the calculation (unless it costs them money, which it doesn't).