Hacking and raping are not comparable. One is an action against a person, the other against a tool. I am not trying to blame them for getting hacked. I am blaming them for being a research organization that doesn't properly use their tools. Its like the lady that spilled hot coffee in her lap from McDonalds. Although the court found McDonlads guilty, was it really their fault? The lady was to stupid to drive while holding a cup of coffee. She didn't properly use the cup. The research company was to stupid to properly use their tools. If the power went out on that machine, it was possible for them to loose information also.

any dept can buy a server plug it in
That is why companies (and most .edu's) have security policies in place. No one should be setting up a server that the IT department doesn't know about.