> "It's even the government's job to protect against crime"
It's the government's job to protect against crime, but the duty of an individual to take proactive measures against becoming a victim of crime ("Individual Responsibility").
--> They won't put a policeman in front of my house just because I decided to not have a door on my house.
-
Equally, (and MUCH more explicitly), it's the legal duty of corporations to protect themsselves against crime, especially if they provide critical infrastructure.
--> They won't put police all over my facilities just because I didn't invest in access-control.
--> In this case, I am not in compliance with the law and considered to invite(!) crime
It's both/and, not either/or. Yes, I have individual responsibility to have a door on my house, and to be careful about walking in sketchy places. And the government has a responsibility to combat crime. Both.
A critical infrastructure company has an obligation to keep their facilities secure. And the government has a responsibility to prevent attacks by foreign actors on critical infrastructure.