Yes, it is their responsibility as stewards of their citizens' data. What point are you making with the word "should"?

Sure, it is their responsibility, but that doesn't answer the question "Does it matter whether the data was poorly secured?"

If your house is robbed, does it matter whether you didn't have a state-of-the-art lock? A robbery is still a robbery.