The company's board and c-suite should be held legally responsible if the company's services do damaging things. Punished by jail time, fines targeting their equity etc.

That would certainly change the game of perverted incentives. I'm afraid they're currently trying to push some sort of absolution of this risk. Even if damage happens they will say we warned people in advance, this was always a risk it's not our fault these systems are opaque black boxes, it's a matter of national security to develop them etc etc.