Data loss or leaks may not be the end user's fault, but it is their responsibility. Yes, open AI should have had shit in place for this to never have happened. Unfortunately, you, I, and the users whose passwords were leaked have no way of knowing what kinds of safeguards on my data they have in place.

The only point of access to my information that I can control completely is what I do with it. If someone says "hey, don't do that with your password" they're saying it's a potential safety issue. You're putting control of your account in the hands of some entity you don't know. If it's revealed, well, it's THEIR fault, but you also goofed and should take responsibility for it.