The Forest case seemed to establish that a breach was 3 points automatically. Then additional points for scale after that. The 4 was due to mitigation, which was accepted by the panel.
Nothing has been consistent about these rulings. The PL recommendations, the panel rulings and their reasoning...