need help

At the end of the day the person who commits an attack is the one responsible.
Any responsibility for allowing the attack to happen is a secondary responsibility which is shared by the manufacturer of the software/system that is hacked and the users/administrators of the system.
in terms of responsibility it goes like this
(1)hacker
(2)software vendor
(3)security personell or system administrator in the case of a company
(4)The end user.

However in terms of a social engineering hack the end user would be partially to blame more so than the software vendor or security people.
but primarily it is always the hackers choice, the victim is always the person being exploited/rooted.
Which side are you arguing for?