You can assume they are using proper hashing for any password related information. So no, these cases of people getting 'hacked' is definitely their own fault. Identical passwords, simple passwords, key loggers, account sharing with people with filthy PC's, anything can be the cause. Virus scanners won't pick up everything either.
If their database was truly insecure, we'd see a hell of a lot more so called hacked accounts.