There are defenses against credential stuffing - you can get lists of pwned passwords (e.g. from haveibeenpwned) and force users who use one to change it. You

There are defenses against credential stuffing - you can get lists of pwned passwords (e.g. from haveibeenpwned) and force users who use one to change it. You can run risk analysis on login and add CAPTCHAs to slow down attackers trying credentials, notify account owners on suspicious logins, possibly require confirmation via a link to an e-mail account if the login looks really phisy, make a different risk-convenience tradeoff (e.g. by enforcing 2FA), ... They won't prevent it completely, but you can make it harder. So I don't think (also) blaming the service for successful large-scale credential stuffing attacks is unreasonable.