This is a well communicated argument.

In the same vein, if a database is breached and personal information leaked, I think most people here would agree it is the company/system at fault, rather than some scapegoat programmer/sys-admin.

I can't believe the amount of deflection/justification in the comments section here. A police officer showed up to a house and shot an innocent person. They either shot a hostage (if they believed the threat to be real) which is unacceptable, or they shot an innocent bystander (if they believed the threat is not real).

This is a process failure, as is evident by how "SWATing" is a known/common thing.