Uber's self-driving car killed a person because its driver was playing on his phone rather than doing his job.
But ... for a project like this, it's the kind of thing they should have planned for and could have easily worked around.
First of all, Uber's setup was to have one person do both the analytics monitoring and safety roles. That's ridiculous. The safety person needs to focus on that alone.
Second, for any boring job, it's expected that people will tend to mentally check out, and you should design it so that a single checkout doesn't cascade to death. They could have had a periodic "press this button to prove you're paying attention", or limited the employee from bringing any device except a limited one with no distractions.
So yeah, she shouldn't have been watching a movie, but Uber shouldn't have had better safeguards for the inevitable attention drift.
I agree that victim blaming is _not_ useful when trying to figure out why a safety critical application failed and should not even be in the equation when developing, operating, or maintaining such safety-critical systems.
But to simply answer the question "Who is to blame for her death?" the blame does _not_ rest 100% solely on Uber, nor the driver, nor the victim. All 3 failed to prevent the accident (and all 3 had the power and indeed responsibility to prevent it).
People are responsible for their own risk management. If I take an unnecessary risk (like jaywalking at night on a freeway) and I get hit by a car (autonomous or not), that's partially on me.