SEC’s Clayton asked to expand cyberattack rule even as problems with current program found