You are blaming the victim. Yes, they could have taken more steps to protect themselves, but those steps are inconvenient and cost everybody headspace and headaches. And if we're all being honest we don't use best practice every time we log into a website.

The real problem is the way that we do passwords. Passwords should either be managed by your browser or your operating system. When you log in to your computer, you log in one time with a public key. And then your OS/Browser automatically logs you into every website you visit by signing challenges instead of by giving your private key (that's essentially what a password boils down to) to everyone who wants to verify your identity.

The same is true for credit cards.

If we want a more secure web, we will replace the password system. It's difficult to use passwords correctly, even if you have the common sense (which a lot of people don't, because they just don't realize it's a bad idea).

It should be a higher priority. People are clearly losing money and losing quality of life over today's insecure password infrastructure.