Knowingly allowing ongoing misconduct or consciously ignoring resulting harm is considered bad faith

Protecting the CEO for the directors’ own interest is considered a loyalty problem.

Both of these things would make them personally liable in a shareholder derivative lawsuit.

California permits personal liability for directors perpetrating harassment and prohibits aiding or abetting prohibited conduct.

That's the directors.

Company wise - actions by the CEO are generally imputable directly to the company. This leads to potential hostile-environment claims even by employees who never had a relationship with the CEO, and those claims have been particularly cognizable in California.

Non-termination is also likely to lead to punitive damages, because it will be seen as "malice" or "reckless indifference".

Value wise - sexual harassment verdicts - depends who sued, but probably <150 million to start, long term cost maybe a billion very worst case.

Shareholder derivative lawsuits (where directors are personally liable if they end up with a finding of bad faith) - insanely more - hundreds of millions to billions.