They won't, and shouldn't. This is a failure by an individual to secure a device for which they had special training and accreditation to manage. There's no systemic issue here, just a company taking ownership of an individual's error.