Depends on what you mean by "professional misconduct." For lawyers like you (and me) the analysis by a bar-association ethics committee might be fairly strict. A lawyer's smartphone likely contains non-public client information such as contact info and perhaps even documents. In that case, leaving the phone (or worse, a laptop) in an unlocked car might be regarded as a failure to take prudent precautions to protect client confidences. That in turn could mean exposure for the lawyer, even though the thief was clearly the most-culpable.
ADDED: The same, negligence-based analysis might apply to security professionals as well: Even though others might be equally- or more-culpable, a failure to take prudent measures in accordance with "industry standards" (a vague term that would have to be [expensively] litigated) might lead to civil liability. See, e.g., The T.J. Hooper, a 1932 case in which the court held that a tugboat's failure to have reliable radios on board was negligent, even though that was not the prevailing practice among other tug operators [1]. It's a case with which all first-year law students (presumably) become familiar.