The U.S. Securities and Exchange Commission has levied civil penalties totaling nearly $7 million against four companies it alleges misled investors about their cybersecurity risks and downplayed intrusions into their systems by the same hackers behind the SolarWinds attack.