We should hold the companies and individuals operating on the internet to the highest standard to prevent such security violations. I am talking about a balance of the barrier here. Guessing meeting IDs is such an obvious and trivial attack vector that it should be expected to be abused.
We look at companies like Facebook and expect them to keep our data safe and if they don't, we hold them accountable even though they are a victim of a crime. Some comment equated that to victim blaming in case of rape and that is just an insane analogy.
Obviously if there is a real world consequence and people having damage they should have the right to get compensated and that is why we expect providers and companies to keep logs, but honestly how do we expect services to develop the highest standard if they can pass the blame to an attacker. At least an equal part if not the majority should be the organization that engineered a vulnerability because in most cases these happen due to improper design. (See programming vs. civil engineering quality discussion)
We are talking about a minor inconvinience through trolling easily fixed by a proper token system on Zoom's end. This is not what the criminal justice system should be prosecuting some teenagers for.