I'm not disagreeing with your overall point but this reads a bit like victim blaming. "Those sexy trains were manned so skimpily, and going down those long routes all alone at night, they were just asking for it!"
For example, if a company chooses to ignore a RCE vulnerability in their software for years, are they to blame when that vulnerability is exploited? I'd say absolutely they are.
One question though, what are the laws like surrounding security for trains in the US? In Canada, security employed by rail companies actually have actually been granted all the powers of a police officer by the government.
1. we do expect people to take preventative measures. I think this is more like someone being blamed for a burglary because they left their house unlocked. I have had car insurance policies that excluded theft resulting from leaving the key in the car.
2. Businesses are not individuals.
https://en.wikipedia.org/wiki/Railroad_police#United_States
Your analogy doesn't quite hold up here.