Yes that's how the game goes. The regulator has to keep plugging holes that the non compliant corporate entity finds until there are no more holes worth exploiting by the corporate entity.

It is an exhausting and practically unending task to defend consumers against malfeasant operators but it is one that governments can and must do.