Behind the curve, now....
I believe what they couldn't foresee was the monetization of "user generated" contents (the business then was selling internet access only) - and the contents that monetize better and are more addictive are often those breaking the law - from the copyright infringements a lot of YouTube is built upon, to objectionable contents aimed at children (and often adults too...), or whatever can generate "clicks" and "ads impressions" anyway.
Thinking that companies shielded from any responsibility will self-moderate and cripple their own business is wishful thinking. They will only act when the outrage grows too big.
It's necessary to decide who will bear the responsibility of contents that breaks the law - the publishing platform or the publishing user (and the latter must then be identifiable).
Publishers may decide to bear the responsibility of the contents shielding users who they believe are in need of being kept anonymous - just like the press always did before - but being then responsible they will have the incentives to verify and moderate the contents - even if it means losing some money.