Sure, it is their responsibility, but that doesn't answer the question "Does it matter whether the data was poorly secured?"

If your house is robbed, does it matter whether you didn't have a state-of-the-art lock? A robbery is still a robbery.