Look, the point is, its a bit like blaming a home owner when there house is left unlocked and subsequently burgled. Just because they made it easier through some inaction, at the end of the day it is the perpetrator of the crime who is the real villain.
When you take other people's money in trust, you have a fiduciary duty to protect it. Incompetence is a breach of that duty. Outright fraud is an even more unconscionable malfeasance. Karpeles and Gox (if they even are separate) utterly failed to carry out the duty they'd agreed to by accepting deposits.
Is it not the case that Bitcoin exchanges are unregulated? As such, isn't it the case that their fiduciary duty extends to doing what they see fit to keep customers assets secure?
Perhaps what we need is some regulation, or at the very least, a code of practice that exchanges are prepared to sign up to that will ensure that exchanges are not able to let such a situation arise again.