The fault here really relies on the design of whatsapp. Not the thieves who saw an open door.
* If I leave the door unlocked is someone entering it and taking my property my fault? According to insurance companies it often is, but not the law. Who's side are you on?
* If I've locked the door, but there's a window that doesn't latch properly, is it my fault?
* If my door doesn't have a kick plate, is it my fault for not providing adequate security?
* if they break the windows, is it my fault for not having bars on my windows?
Making software secure is hard, but saying that the existence of any bug instantly means that the software manufacturer is culpable for how someone [ab?]uses those flaws is clearly nonsense. No one wants to deliver software with bugs in it, but NSO is clearly ok using those flaws to attack and kill reporters and HRAs.
Isn't that also the case with every phone and desktop email client?
More seriously: I thought they popped WhatsApp on iOS as well? That would imply sandbox escape there as well - although the default iOS sandbox is more a quarry :)