If major corporations like Toyota, FedEx, and 37 other customers got hacked, that is a deficiency in the design of Salesforce.
They are large companies, but TransUnion was the only financial services or healthcare company I noticed in the list of companies breached. Most companies outside of those sectors do a horrible job with security. I work at a healthcare company with 15 Salesforce orgs, and we would have been well protected from this even if an admin was tricked. And we have 3 tiers of admins with only the top tier having enough permissions to do what was necessary for this hack, and it's very unlikely that our most well trained security focused admins would have fell for this social engineering.
Companies need to be properly penalized when they are breached like this, because these attacks would have been trivially dealt with by decent security measures at these 39 companies. The problem is that decent security measures don't come cheap, so the penalties have to be high enough for the cost of good security to be a no-brainer.