This “it’s their fault for sharing information” is a terrible externality/unaccountability argument. As a company, you are responsible for the safety and privacy of all your direct and indirect users. I don’t have a facebook, but I’m in there for sure, and it’s the company’s responsibility to protect my privacy.

I know this is not 23&me’s case, and sure, the front door keys weren’t stolen from them, but they allowed the whole museum to be robbed without triggering one alarm. If a bad actor gained access to my account, he/she would still need my device to deobfuscate card info or make transactions.

I mean, it’s a solved problem!