Something similar applies here with weapons. If you are a legal weapon owner, it is expected of you that you take care so that nobody can just pick up your gun and start shooting. You need to store it unloaded, munitions stored separately, and all that jazz. The same thinking goes for the unlocked car thing? What if a child gets into your car, starts it up and drives over their siblings? In a way, the car owner would be responsible because they didnt ensure the car was properly locked.

Same thinking should apply for sensitive data. If it gets stolen, it should always be the responsibility of those which have been charged with taking care of it.