I'm not sure I see your point unless you're saying that opting into a feature a site offers also means they are taking on implicit risk of that feature causing a data breach through no fault of their own? Again how is that their problem and not the website's?
if you choose to share data with Bob, you have to accept the consequences of Bob being sloppy with your data
Isn't that obvious? If I share a Google doc with you I'm taking the implicit risk that your account might be compromised along with my document when you e.g. forget to log out at a public computer.
I think it is unreasonable to blame site when you allow sharing data by certain separations. Like in social media set your friends' friends to be able to see your data. If one of these friend's friend is bad actor. Is it really on the site to prevent them seeing the data?