Side note: this is part of why we have blameless postmortems even when there is a clear place to assign blame. Acting on the blame takes a different route and sometimes that route is needed, but it also needs to be part of a different analysis
Because when a problem in a system is exploited you have two problems. The first is who did it, the second is that the system could be exploited by them in the first place, and focusing too much on the first undermines the second in a great many cases