Why do hacked companies only have to pay for 1 year of identity protection, but your leaked personal info can still be used to steal your identity forever?

Why do compromised companies get off easy by only having to pay for 1 year of identity protection, when my leaked info can potentially be used to cause me harm forever?

It's not like my social security number will expire in a year so it will be useless after that!

If my info is leaked by a company, then they should have to start paying me $10/mo \*forever\* to cover the cost of identity protection for as long as the …

companies compromised easy hacked harm identity identity protection info leaked pay personal privacy protection steal