I disagree – in the end, the responsibility lies with Lastpass. They chose to use a third party for their backups, and there are reasonable steps they could have taken to mitigate this. The most obvious step would be to encrypt the backups with a physically secured master key.

Even without the breach, handing this data to a third party, containing as it does sensitive, unencrypted user information (such as the list of sites you have credentials stored for) without taking appropriate precautions was unacceptable.