Equifax was compliant. Target was compliant. Anthem was compliant. The frameworks worked exactly as designed. The breaches still happened. Here’s the distinction that matters.