Agreed. Cloudflare level of transparency should really be the minimum in cases of security breaches for all companies with any user/customer information. And when found to be purposefully hiding that information you should have your right to do business at least suspended in the US.

A policy as such would -

1. Incentives disclosure (or your essentially DOA in US)
2. Increase the IT budget and force more security over profit (because again the alternative is no profit otherwise - or at least many detailed explanations on how the company still isn't doing anything)

EDIT - spelling/autocorrect battle

Every sale to every individual buyer requires separate handwritten notice, each individually attached to a copy of the privacy policy and the data sold, notarized and sent by certified mail in triplicate, with postage paid by the sender. Make it cost so much that the entire industry becomes obsolete.