She's a data scientist, not a security expert. Holding her to this standard is unfair and very much blaming the victim.