I would definitely say it's the responsibility of the application developer to secure user account information, in addition to being the nice/right thing to do.