It would be like a chef who doesn't wash his hands firing a line cook for not washing his hands. A company giving their executive who stores social security numbers on the same system on which she opens emails (and trusts them implicitly without a second thought) a free pass is a way for them to give themselves a free pass. If she were to be held responsible for not understanding basic security protocols then the company could be held accountable for failing to train her properly. Until we raise our standards the companies who compromise our privacy and security will have no incentive to raise theirs.
Do you have a right to behave as if every link and file is safe and secure or should the people who are tasked with protecting personal information be expected to behave with reasonable suspicion of wrongdoing on the part of perfect strangers? HN wants to have it both ways, apparently.