Although this is a simplistic example of what is obviously stupid... There is an argument to make for her.
First, she does not know beforehand this is stupid. Second: Are not all hacks stupid afterwards? It is only a question of how professional you can and will/must do stuff. There are hardly any laws on how much one has to lock down and tripwire operational systems to detect penetration (attempts). There is always the commercial pressure of feature (over security costing money). I have seen many security departments being overruled because function is more important (that includes banks). Just check online how many banks actually implemented a feature like DMARC on their domain (with policy:deny). It tells you exactly how lax securiy rules actually are.
Nobody takes responsibility because noone has it. The only stupid thing she can be blamed of is not having a company policy to CHA.
