Generally it's the people who have intent to break the law who are prosecuted, not their victims.
Absolutely. That's why I stopped validating passwords and emails. Nobody votes with their wallets anyway, so I don't have to worry about losing customers, and regulations only go after the evil hacker testing whether 1234 might work as a password, not me for choosing not to check its hash against my database. Law-abiding citizens would never try to impersonate one another, so I'm sure fraud on my platform is low.
Some think it was North Korea ;)
This is absolutely false. But I understand why someone would believe that in this joke of an industry where all the liability often falls on the user.