You might. 'In any other context' we would do no such thing. And I am quite happy to hold both parties to account for negligence and no small degree of (in AT&T's case institutional) malice.
Being careless with other people and their things is a crime. It's just a matter of managing the prosecution.
Criminal law is all about intent. There are four kinds of intent (under the Model Penal Code): Purpose, Knowledge, Recklessness, Negligence. Mere negligence is rarely the basis for criminal liability (it is, however, the basis for tort law). Criminal liability starts at recklessness. Weev is punished and AT&T is not because Weev intended to improperly access data he was not supposed to access, while AT&T was merely negligent in allowing him to do so.
We treat the stupid better than the malicious, and I personally think that's a good thing.
It's also possible that AT&T violated data privacy laws in certain jurisdictions, which might or might not be a criminal matter.
I'm not particularly interested in defending Weev, though I have to say that prosecuting someone for accessing data you published on the Internet with no access control does not a good reputation make.