A newly proposed order against Drizly will also bind its CEO to specific data security-related requirements after a 2020 data breach.