This feels like a really odd way to incentivize data breaches and/or not reporting data breaches.

Um, I think it does the opposite of what you are suggesting - this aims to reduce data breaches and incentivize people to prevent these breaches.

If 10% of revenue is still cheaper than building secure systems ...

Perhaps what would help is a progressive system, where you'd pay 20% the next time.