My impression from OP wasn't victim blaming, but more of a ruthless "break a few eggs" in order to have enough of an impact for other critical businesses to take security more seriously.