Yes, it is their responsibility as stewards of their citizens' data. What point are you making with the word "should"?
If your house is robbed, does it matter whether you didn't have a state-of-the-art lock? A robbery is still a robbery.
It very much does matter.
If I walked past, saw it and remembered it or even recorded it, is that honestly theft?