one might argue that by not protecting the user's personal data by default, when how to protect such information is quite well known, the vendor and market maker is clearly the liable party
Would you argue this for your desktop or laptop as well? For any breach due to you installing an application from someone who abused your trust to read your files and upload them, that your OS vendor (Microsoft, Apple, your Linux distro, or whatnot) is the liable party?
