i think the developer cannot held the responsible.On one hand,the system was sold to the operator,whether the system was attacked or not,it wouldnot be related to the developer,each matter should be solved by the operator.On the other hand,there's one reason if the operator operated the system terrible,it also increased the risk for others to attack.And every system is not extremly perfect,so,the responsiblity should not belong to developer.