Again, if you really want this to happen less often, then you must focus not just on punishing one person while leaving all the people who participated in the whole fraud alone or even grant them the victim status.
Kids should be protected 100%. No question about that.
Adults should be held responsible of what they decide to do as long as they were not physically constrained, or unless they are *really* diagnosed as mentally disabled.
Anyone having participated in this whole Theranos mess IS liable. (Not talking about customers/patients here, but everyone else: investors, managers, even employees, at least engineers who I'm sure knew after just a couple years that something wasn't right.)
As long as we will fail to properly acknowledge responsibilities in *allowing* frauds to happen, they will. Punishing a single person (or just a very limited few) identified as a big criminal responsible of everything while the rest was merely victims is never going to work.
So sure, she should be punished according to the damage she made, but we should not focus on her IMHO. We should reflect on ourselves and asking ourselves what we can each do not to allow this to happen again.
Maybe some honesty, less greed, doing our homework/due diligence and getting some education will help.
There will always be criminals.
The question to me is, what we, non-criminals, which are actually the majority (thankfully), can do to avoid creating favorable contexts for at least certain kinds of criminality.
As a metaphor, imagine you leave your house door wide open 24/7. The probability of getting robbed would be extremely high. Would you then spend all your efforts in courts to make sure the robbers are harshly punished, while still leaving your door wide open and never recognizing you were doing something stupid, while it was pretty obvious? Would securing your house, even a little bit, not be a considerably more effective method?