I worked for maybe a decade in Investment Banking back in the 2000s and early 2010s and one thing I realized after a couple of years in the Industry was that fines for lawbreaking were really just another business risk and calculated into the Profit & Loss estimations.

Looking around I would say that, at least amongst large companies, that practice is now the general rule in just about all industries - if the only penalties are monetary and paid by the company, individuals controlling budgets within companies will treat fines for regulatory non-compliance or even crime just like they treat any other business risk.

Make people personally liable for crime committed for the company (including using criminal association laws against companies) and fines a percentage of a company’s revenue (like the EU does for certain modern pan-European legislation) and most of these things would stop - there would be no need of Luigi doing what he did if Brian Thompson and those like him would’ve gotten jail time for Manslaughter if even just a single case of people being fraudulently denied life-saving treatment and dying could be shown to have been the result of his policies in the company.