That's a pretty weak straw man; a data breach is entirely different to a store being robbed, as you well know.

One might as well ask

Why does anyone stay in business in CA?

since (I believe) Californian state law has similar reporting requirements (and fines/civil liability) for breaches.