Certainly, because it is. I don't think it's wrong to view companies responsibilities as being different from those of an individual.

For example, if a company chooses to ignore a RCE vulnerability in their software for years, are they to blame when that vulnerability is exploited? I'd say absolutely they are.