Whose fault is it to start with ?
The Virus writer ? For exploiting a vulnerability
The End User ? For not patching the vulnerability
The OS writer ? For creating the vulnerability