People need to be held accountable for the security of their systems when they are storing personally identifiable information on customers or the public at large.

Edit: Perhaps they shouldn't be blamed when someone leverages a zero-day to break in, but if this is due to their failure to patch their systems, IMO their 100% liable for everything that follows.