Criminal negligence is a thing.

Absolutely. That's why I stopped validating passwords and emails. Nobody votes with their wallets anyway, so I don't have to worry about losing customers, and regulations only go after the evil hacker testing whether 1234 might work as a password, not me for choosing not to check its hash against my database. Law-abiding citizens would never try to impersonate one another, so I'm sure fraud on my platform is low.

Some think it was North Korea ;)

This is absolutely false. But I understand why someone would believe that in this joke of an industry where all the liability often falls on the user.