FRCP Rule 23 really needs to be reformed. The reality is there likely shouldn't be a certified class in may of these cases, if the rule or the case law were followed. Instead, courts are approving dubious settlement classes, with limited resources to review anything, and consumers are getting minimal recovery.
That said, most of the time, the damages any individual consumer experiences is relatively low. Like in the above settlement, baring actual identity theft, you likely would never be able to prove actual damages to get something more than nominal damages. So you'd likely only ever be entitled to $10 in damages if you sued.
What you should be entitled to, and what should be available but isn't, is penalties. I'd be interested to see if folks ever had a desire to expand qui tam (private parties suing on behalf of the government) to expand penalties payments out of these companies, rather than doing these BS class cases.
On top of that, class administrators are absolutely a problem: https://www.vitallaw.com/news/antitrust-news-class-action-administrators-and-banks-named-in-suit-alleging-secret-kickback-scheme-that-suppressed-settlement-payouts/ald01e2f28b76305245e097ac15f43a74e28f