Apply the parent/grandparent situation:
If non-tech-savvy users are likely to get hijacked, then the system needs to accommodate them. Most credit cards have fraud protection (if your card is stolen or cardmember account hacked, you are not liable for any charges incurred, if you report the issue within 60 days or so). Valve's customer policies are inferior to those of the major banks? Ouch.
Or consider this situation: If someone steals my car and then hits a pedestrian, should I be charged with manslaughter? But I locked it and it had an alarm system!
Also, anyone can be hacked. You can be the most paranoid user in the universe, and there remains a possibility that your information will be stolen. From the perspective of IT security professionals, you must assume that security breaches will occur, and plan responses accordingly. The, "my security policies make me invulnerable, so puh!" approach is inappropriate.
Blaming the victim is more convenient though, yes? All victims of crime are at fault for the ills wrought against them.