Nothing is stopping the perpetrator of a BGP hijack as a result of a forged or otherwise illegitimate LOA from facing civil litigation as a result of revenue loss or other harm done.
This thread and others like it highlight that there is absolutely some negligence here and could very well find itself in an evidence pile at some point in the future.
So there IS liability, but the lack of solid precedent means that the bean counters can't assign a dollar amount to the risk associated with blindly accepting LOAs, and therefore it might as well not exist.
Someday, somebody will have the pants sued off them because they let their new customer hijack the hell out of a government entity, bank, oil company, etc. and we'll start to see better processes.
-Matt