A good analogy might be germs. It's probably not reasonable to expect most businesses to have a plan to handle a global pandemic, or to vaccinate the public against seasonal endemics. But it's probably reasonable to expect most businesses to be aware of germs and take appropriate measures to handle and protect against them.
Hospitals being very sensitive to germs, should have strong sanitation protocols. Food processing, likewise. The government should regulate this.
A factory making cars, maybe less regulation is required, though a general baseline prohibition on unsanitary working environments makes sense.
I'd say in the current threat environment, hacking/phishing attempts are closely analogous to the baseline level of attacks that our immune systems are subjected to. Countries that harbor hackers could be analogized to dumping effluent into a river up-stream of a city; it's probably the government's job to clean that up. But also, if the river is unsanitary, in the meantime it's reasonable to be critical of companies that obliviously use it for rinsing vegetables.
Under this analogy, it's both reasonable to expect companies to be aware of germs and take precautions against them, since they are a fact of the environment, and also to want the government to take the lead on cleaning up egregious sources of germs, since that's not something any individual actor could do on their own.
