Yeah, it does need to be solved by the website. That doesn't change that users are vulnerable and don't know about it.