You're confusing ethics with legal liability. Nobody is saying IT is ethically responsible, they're saying they are legally responsible since the entire reason they get a paycheck is to prevent these sorts of things. Reduce it to a contractual matter if that assuages your conscience.
If you hire a bodyguard and still get shot while the bodyguard is on his phone both the perpetrator goes to jail and the bodyguard gets fired/pays restitution. Not that unheard of. It's not like one person gets all of the legal and ethical blame and everyone else is entirely absolved.
I'm not confusing things. I'm saying that public discussion seems to migrate towards prevention/mitigation and de-emphasizes the criminality. I'm arguing that we not forget that and pointing out that it was missing from the post I responded to.
In your bodyguard example I don't think in that type of a situation that people fixate on the quality of the security detail. They rightly demand that the shooter be tracked down.
People talk about it that way because locking your doors is more pragmatic than eliminating every criminal in the world for all time? Because the purpose of conversation about preventable injuries should be constructive, rather than idle? Because whether someone should do bad things should be a discussion between people who do bad things, but people who are victims should be discussing how not to be victims? Because when someone trusts you to protect something, there's 1) an assumption that that thing could be damaged, or else no reason to have hired you to protect it, and 2) a moral responsibility as the person entrusted with guarding it to do a good job, or else your taking money is wasteful and your promise made in order to get it is fraud?
Any number of reasons all boiling down to the same reason: what does calling bad people bad accomplish? Best for people who want to be good to talk about how to be good.
We have the same likelihood of bringing the criminals to justice as someone who left a laptop on a bench at an international airport for several days and then went back to look for it.
We can blame the criminals, but we will always have criminals when the crime is easy.
Those who are really responsible here are the ones who allowed themselves to become dependent on an ancient and insecure operating system.
To me, the buck should stop with the head of the hospitals.
What's the point of discussing criminality? The criminal justice system is centralized and functions independent of public interest in getting results from it. (And, in fact, functions better when the public is mostly unaware of crime, re: jury selection.)
The civic justice system, on the other hand, is completely driven by public interest—nothing gets done to change things unless somebody (or some class) bothers to sue.
If you hire a bodyguard and still get shot while the bodyguard is on his phone both the perpetrator goes to jail and the bodyguard gets fired/pays restitution. Not that unheard of. It's not like one person gets all of the legal and ethical blame and everyone else is entirely absolved.