We need some kind of monetary punishment for not protecting user data. Simultaneously, we need to give tax breaks for companies that have had a streak of many years of taking security seriously without leaks.

Increasing bug bounties doesn't happen when the executives do not have a culture of security in their company. That's a loss cost center for them. We need a different incentives that go beyond just rewarding hackers with bug bounties.