I'd argue on the scale of a company like in this example and other high-profile example that if you're integrating software with such glaring holes in your network then you're the one who is culpable.

Obviously if there are unknown vulnerabilities that is one thing, but there is a level of due diligence you should practice as the operator.