Which one in this chain should be blamed for not taking care of security: Phone manufacturers, GSM operators, SIM card manufacturers or OS systems (Android, iOS, etc..) to protect our phones from connecting to rogue GSM antennas? It seems so easy to get hacked, just attacker sets up a rogue tower and that's all.
Users - and thus also phone manufacturers and network operators - want the ability for phones to connect to all kinds of operators throughout the world. It's a clear benefit that if you take your phone, fly across the ocean, and turn it on - and it becomes able to receive and make calls. This means creating and using standards that enable the phone to negotiate a communications channel with any tower following the standard - including operators that were established after the phone was manufactured, including cell towers with technology generations later than when the phone was manufactured.
If I today launch a new cell operator in Wakanda, and put up generic tower hardware, then phones of visiting tourists should transparently connect to them, otherwise they'll be very unhappy that phones don't work in Wakanda. And the phone can't distinguish this scenario from me putting generic tower hardware next to your office. A global "whitelist" of operators would have technical challenges (how would an old non-smart phone w/o internet access know about my Wakanada operator that I launched yesterday?), and also require strong international cooperation, which is unlikely - for example, there are mobile operators running in disputed territories or conflict zones, where the local governments could prefer to "veto" them.
An operator may be "renting" some towers from another operator - e.g. they want the phone to transparently connect to the other operator's tower. There also are virtual operators, who don't have any towers of their own, but they're paying tower operators for the provided service - and they want their phones to connect to all those towers where they have agreements. So phones connecting to towers not controlled by "your" operator is an important feature of the network that makes it work.
While you generally get notifications for international roaming, for this operators don't want you to get notified. One reason is that for branding reasons, the operator very much does not want users to know that they don't have direct coverage of that spot and you're actually using a competitors tower; the other is that in such cases simply driving down a highway would get you a dozen notifications as your phone repeatedly switches network cells.
Risk doesn't affect operators and manufacturers
Another aspect is that from the perspective of the operators and manufacturers, it's not a particularly relevant risk. It doesn't enable stealing of service or cause loss of revenue for the operators; doing so is illegal (regulated frequencies) so it's not going to be used by other companies to offer competing service; it doesn't easily enable fraud for commercial gain, so it's unlikely to be that frequently used by criminals to cause consumer backlash.
The most common abuse of fake towers is surveillance by law enforcement agencies, and the operators and manufacturers don't have a major reason to prevent that. Yes, there is also some risk to the users, but it's marginal enough to consider it as something that would be nice to fix, but not important enough to harm the (very important) interoperability while doing so.
I would answer the the one that is to blame is the user - at least with decent phones and providers - and the phone manufacturer/phone provider.
Peteris has explained why by default a phone will try to connect on the first tower that will accept it. By on my old Android phone, I have found an option to lock the phone on one single network. It will not work if I travel abroad, or if I use a virtual provider, but it would be enough in my use case to forbid a connection to an unknown network.
Ok is it possible for a rogue tower to pretend being member of a well known network, and I do not not enough on the underlying protocol to know how exactly that kind of attack is possible.
But anyway, when travelling abroad I have alway been warned that the phone was about to connect to a different network.
Of course, at the OS/phone manufacturer level, it should be possible to whitelist a number of networks and forbid any automatic connection outside that range.