Fabricating data is fraud. The reputation of the university is harmed. The public is harmed by potentially providing grants for follow up research. Other researchers are harmed by wasting their time. It seems like one potential fix would be to prosecute people who perpetrate such fraud.
Prosecuting the PI for fraud might be possible. I'm not able to google for cases where that has been done, but I'll bet it's occurred before. I'm doubtful that the student could be prosecuted.
One basis for a fraud claim would be the statement that accompanies most grant applications, generally of the form, "X is the PI of the proposed work, and has the responsibility to ensure the quality of the investigation and scientific results..." -- and the PI signs their name, and takes the money. (And so does a university official.)
