Ethically, I think you're correct that it's their responsibility to do what they can.
Legally, the court in this situation thought it was somehow Microsoft's responsibility to fix it.
Economically, I'd say being held liable to what users do on your platform will hurt innovation and competition.
In terms of liberty, botnets and spam don't seem like they compare to an attack on someone's business, their users, and their freedom to operate independently.
I guess you can choose which perspective makes the most sense to you, personally.