There are several reasons why prison sentences make sense in this scenario.

Or phrased differently: without prison sentences the whole situation becomes a pure numbers game: did they get more money out of the false reports/not fixing the bugs causing this misbehavior then they now have to pay in damages.

These kinds of crimes will continue to become the baseline if there are no real consequences to the people actually being responsible for the deeds (this includes the CEO).