If you are working for a company using computers they will send you either a memo or send you on a course.
Normally these computers will already be administrated stopping attacks on their network, I'm not sure if this is a fact or not but the majority of computers are in the workplaces.
so after being sent a memo for example saying don't use commonly used passwords, or don't open attachments without consulting the admins, if they do not follow these rules can you not place the blame upon them?
Home users, they now have the support for all these things, if you buy a pc from pc world for example (not recommended

) they now have "tech guys" who will install basic security.
Now this should stop most silly viruses.
Now if that user disables their firewall or AV they would be to blame.