It also serves as a proxy for a punishment. They are, from one perspective, paying a voluntary fine based on their own assessment of their security failings.

For customers it signals sincerity and may help dampen outrage in their follow up dealings.