One thing I am confused about (maybe more like suspicious about) is why fines for stuff like this aren't more onerous. There are lots of businesses that just factor in the cost of the fines which are way less than the total margin.
If I were designing regulations like this, and I actually had the goal of curtailing this sort of behavior, the fines would be tied to the total revenue of the product, like (total revenue + capital gains) * 1.25 (where the .25 is the punitive fine %)
That way there's no business tradeoff except "if we get caught, we're fucked". Like, in this situation the fine would be all the revenue ever made with the product for 40 years, and whatever interest they could reasonably calculate, times some proportional punitive amount. J&J would maybe be looking at a bankruptcy for it.
It may be too much, but I'd also be tempted to look into criminal charges for anyone with fiduciary responsibility related to the breach. So like the people who were directly responsible are charged criminally, but also their manager, and that person's manager, and so on up to the CEO. If line workers doing shady things could blow back into jail time for CEOs, certainly CEOs would be way more interested in making certain that everything was on the up and up. Just build in corrective procedures like a window for disclosure to law enforcement or regulators if something shady is discovered internally, to give the company a chance to correct the situation if there's a rogue actor or whatever.
I know the idea is impractical in a variety of ways, and as a person who has run organizations of various sizes it scares me to contemplate because I know first hand that people just do dumb shit sometimes and I can't always stop it.
But the incentives do feel too far the "it's easy and profitable to get away with" side.