The government provides for the common security. That's one of it's most fundamental jobs.
Imagine if your house was destroyed by a Russian drone and you were thrown in jail for not having enough "defense in depth" against drone strikes.
Let's say you are the leader of a border post, and you leave your post unmanned allowing the enemy in - of course you will be held accountable.
Exposing stuff to the Internet despite the manufacturer warning against it is at least grossly negligent and should be punished.
We are at war with Russia and China on a nation-state level and on top of that we also have cybercrime gangs.
Yes! Because if you are a member of the state operated defense force, then defense is your responsibility. The state is responsible for defense.
If on the other hand, you are a civilian who just happens to own property near a border, you have absolutely zero obligation to defend the border yourself. The same is true for businesses near a border.
> We are at war with Russia and China on a nation-state level and on top of that we also have cybercrime gangs.
Man, if only society had a way to form some sort of governance body which could provide defense against other nations and provide some sort of justice system to protect against and punish crimes. Oh well, I guess its every man for themselves ¯\_(ツ)_/¯
Let's not say that. Suggesting that civilians have defence duties on par with members of the military is ridiculous.
Not aware of any country in the world that is currently in a declared state of war with Russia and China.
Just how much evidence do you need to realize that the actions of both Russia and China have been - for years now - to undermine Western societies and the global set of rules?
For one, we need to hold commercial vendors accountable - that means especially to refuse to provide security updates for the reasonably expected life time of a piece of software or hardware.
But especially, we need the companies using IT systems to be held accountable. The magic word is "defense in depth" - the scenario of the post we're talking about is a piece of equipment that was not supposed to be reachable from the Internet and despite that knowledge it was made accessible to the Internet. Seriously, anyone caught exposing dangerous stuff to Shodan should be fined to hell and back. Or to continue using your military comparison: most governments have laws that call for harsh punishment for "aid to the enemy" or similar. Time to update the law to the new digital world.