If we can't prove this for billion dollar corporations that leak nationwide user data, I don't see how a judge will find 4chan grossly negligent.

Typically you need to show a "conscious and deliberate disregard" for the rights or safety of others, for it to be considered gross negligence. We could argue six ways to Sunday whether or not that's the case, but the only opinion that matters legally is a judge's.