Two things can be true at the same time. In this case, that the malware authors are responsible, and that the hospital/management were negligent.

Negligent circumstances seems controllable, whereas having no bad actors in the world (particularly the international world, including rogue states) seems nearly insurmountable.

Every time this happens, I'm going to keep saying the same thing: Management let this happen. The dangers are known, the risk mitigation is known, and their failure to act is tantamount to negligence. This didn't "have" to happen, they allowed it to happen.

But as I said at the start: Two things can be true at the same time, management's negligence let someone die and the malware authors are responsible for the death.