A side note: there is a well-defined value of "acceptable range", i.e. regulators regularly make decisions based on whether the cost of a change would be more than the "statistical value of a human life". (https://www.theglobalist.com/the-cost-of-a-human-life-statis...)
The question is whether, through regulatory capture or negligence, monetary costs are being valued too highly.
It's not a cynical measure of what makes more money. The risk tolerance is set a lot smaller than that level. Which is a reasonable acknowledgement that you can't prevent all risk. At some point the overhead of your anti-risk measures starts causing more harm than good.
The question is whether, through regulatory capture or negligence, monetary costs are being valued too highly.