I don't hold that one against them... they were not a willing participant in it, and at the time one wouldn't have reasonably included that in a threat model (a

I don't hold that one against them... they were not a willing participant in it, and at the time one wouldn't have reasonably included that in a threat model (and still isn't a part of a threat model for most people), so I wouldn't say they were negligent either.