Of course the ransomware authors/controllers should be (and are) culpable. But when financially lucrative attacks can be carried out with very little risk of b

Of course the ransomware authors/controllers should be (and are) culpable. But when financially lucrative attacks can be carried out with very little risk of being caught, and the results are so bad, organizations who don't take security very seriously are at fault for not recognizing the threat landscape, and government is at fault for not recognizing that the market isn't solving this problem, stepping in and requiring higher quality assurance or liability for software.