If you start mandating companies do proper authentication, then you kinda need proper authentication to be possible. Really, the way to do that is through a government-issued ID, but the US does not like that idea.
Without government-issued ID as a base, doing authentication right is difficult. Especially account recovery simply becomes a mess. Having high fines might cause certain users to be permanently locked out 'because we cannot properly authenticate you'. It would light a nice fire under efforts to properly handle authentication, but that fire would burn a lot of people first.
This is at the root of the problem. No entity wants to take liability and responsibility for quick and easy identify verification, and only the federal government is in a position to do that.
There is no reason they could not use USPS to provide a passport type identify verification service and API for other organizations to use. It should be a utility.
The crazy thing is no one needs to be forced to get. We already have passports, and they are initially applied for at USPS. All the feds need to do is set up an online verification system with an API to plug into.
Without government-issued ID as a base, doing authentication right is difficult. Especially account recovery simply becomes a mess. Having high fines might cause certain users to be permanently locked out 'because we cannot properly authenticate you'. It would light a nice fire under efforts to properly handle authentication, but that fire would burn a lot of people first.