And when the victim doesn't do reasonable actions to safeguard, yes, they are also partially responsible.

If I hooked up a whole server infrastructure, made it possible to remote in to anything as root, no firewalls, no WAF, and security was an afterthought, I would still be responsible for bad actions not becoming with standard and acceptable security.

Even if the hackers shouldnt be hacking, I still did it wrong. I'm still partially responsible.