The latest version of the US "cybersecurity" bill still has the big flaw that companies could disregard users' privacy "voluntarily".