Sure, it is their responsibility, but that doesn't answer the question "Does it matter whether the data was poorly secured?"
If your house is robbed, does it matter whether you didn't have a state-of-the-art lock? A robbery is still a robbery.
If your house is robbed, does it matter whether you didn't have a state-of-the-art lock? A robbery is still a robbery.
If I walked past, saw it and remembered it or even recorded it, is that honestly theft?
It very much does matter.