If I lend you my car, and you park in Berkeley leaving your laptop open on the passenger seat... Yes it's your fault my window got smashed and I'd like you to pay for it. Is it your fault your laptop got stolen? Maybe, that's just semantics. But my window being broken is your fault because we all know thieves exist and look for items on seats.

So if you upload your id to a flash in the pan website, who's fault is it when the rookie website turns out to have expectedly low security?

The car was at least be locked and have windows closed. In this case, it was an unlocked car with doors and windows open.