If you go into house with no locks and steal something, you should still be liable for your actions.
(Granted, that doesn't dispute the fact that the actor is still deserving of a lot of that liability. :) )
Better analogy- if I put some items up for sale in a consignment shop, and the shop owner doesn't lock the door overnight and someone runs off with all my stuff, I'm likely to be more upset with the shop owner than the actual thief.
But anyway, I wasn't talking about who's liable, I was simply stating the fact that those developers were criminally negligent.