Of course there needs to be consequences for thieves but that doesn't absolve people (particularly in critical infrastructure) from the responsibility to implem

Of course there needs to be consequences for thieves but that doesn't absolve people (particularly in critical infrastructure) from the responsibility to implement reasonable protections. If everyone keeps their doors unlocked in town and hundreds of burglaries occur as a result, the police should do something about it, but they may not be staffed to go after everyone. At some point they're going to be telling people to lock their houses please. "Password practice" is thankfully becoming less and less relevant as hardware security tokens become more widespread, affordable and reliable. IMO there's zero excuse for a critical infrastructure operator not to use 2FA at this point. Whatever the password policy is, people (consumers too) should really not use passwords as their last line of defense.