I'm well aware of victim blaming, but sometimes it's justified. If someone hacked into your bank account and stole your money because of a security flaw your bank decided to put off until later, surely you would lay blame on your bank as well, no?

Let me be perfectly clear, lots of the blame lies with that attacker. But it is also the responsibility of the a web host to fortify their systems sufficiently, which clearly wasn't done in this case.