Federal officials are holding the CSO of Uber personally responsible for violating the law and failing to disclose a 2016 hack. The company has already been fined. Adding personal liability for a top official is a pretty big deal—and a huge disincentive for future CSOs to do the same. But is it actually fair?