[alexb_]

As mentioned in the article:

>Many Windows users are even contractually “forced” to fix (all) such security warnings within a certain time period or risk bad consequences and penalties.

So the blame would be on managers who think checking boxes is how every single job works.

[zaphar]

Many times those managers are not responsible for the contractual obligation either. It's one of those comedy of errors type situations where no one single group is fully responsible but put all the decisions together and bad things result.