> But X is at fault for ludicrously bad security practices and Y exploited said bad security illegally are not mutually exclusive. No, but even that wasn't the

> But X is at fault for ludicrously bad security practices and Y exploited said bad security illegally are not mutually exclusive. No, but even that wasn't the case here. When X has NO -- not even "ludicrously bad" -- security, Y can't have "exploited" anything, because there was nothing for them to exploit.