The challenge with law making has always been to balance the requirements of enforcing them without excessive 'creative interpretations' with the need to allow enough wiggle-room that they aren't overly strict about things to allow no leeway.
Police often don't know the exact crime someone is committing when they arrest them, that's worked out after. And that's not malice, it's just that they don't have the entire law memorised but have a pretty good idea they're doing something worthy of being arrested and the details of what to charge them with formally can get worked out after they're removed from the scene.
This is why I think police should be held to a higher standard than the general public, and ideally have the numbers to let them patrol regularly, visit local schools and community events, that kind of thing. Because the police force can only really work when there's a level of trust between officer and the general public, on both sides. When that trust breaks down, such as if police regularly cross the line', then that social contract breaks down. People trust the police less to actually be a force for good, so police have more room for an us-vs-them mentality to grow, so they trust people less and abuse them more, so people trust them less...
However, our culture has traded security for convenience.
To be fair, Security and Convenience isn't a new trade-off. There's a reason we don't all have triple-locked retina scan magnetic latch front doors and backup generators to keep them running in the event of an outage, and impact-resistant glass windows with iron bars, after all. That'd be way more secure, but not very convenient.
The ratio has always been convenience-vs-security, and it's always had holes in it but the balancing act is to maintain how much security is enough security to cover most scenarios without creating too much inconvenience or cost that people just say "fuck it" and find a way to bypass that security.
If given the chance, a majority of people have always done the convenient thing over the secure thing, and often without realising. Password reuse isn't a problem because of a lack of awareness, it's a problem because having and remembering multiple passwords when you lack the technical knowledge to select use a safe password manager is difficult. And we haven't come up with a reliable and accessible way to replace passwords yet.
The tricky thing with modern computer systems isn't accessibility, sensitive information is often harder to get at individually than it was when everything was printed and physical, but scale: A single breach can leak a lot more information in one go.
I wonder if governments should mandate (and subsidise) regular pen tests for private businesses, maybe with requirements for businesses to close any holes found in a certain time period or face fines. I've not thought it through in full.
Large responsible businesses do regular pen tests anyway, and it doesn't catch everything, but there may be something to the idea in terms of closing off the lower hanging fruit businesses.
Laws like GDPR already try and mandate that certain types of data must be stored in certain secure ways, but the law is still catching up with the technology and at the same time can't outstrip it too much unless businesses just 'forget to implement' it because of the cost to do so. And enforcement is tricky without mandating 3rd party validation, hence why the laws are mostly there for after-the-event fines.