School districts may not have to disclose cybersecurity incidents to families or employees. Yet, opting for secrecy comes with even bigger problems.