Strangely enough, people like Matt Blaze are out beating the "don't blame the victim" drum by stating the exact opposite, giving a pass to large enterprises under the "patching is hard" mantra:

https://www.cs.columbia.edu/~smb/blog/2017-05/2017-05-12.htm...