I pick number four: education. Which goes back to my point, that we need some sort of public awareness day on what Internet security _really_ is, or something - I don't really care what it is - to change the narrative. Otherwise we're going to have some huge disaster to some major infrastructure because of an unprotected remote connection like the article shows, and the company that committed it will likely cover up the cause.
Of course it isn't, but when did media stop at that ? Link baits and ad revenue are more tempting then integrity.
Freedom of press, monetization and responsibility - pick two.