Insofar as you wish strong passwords to protect your server/service, it is your "fault" if your policies are too lenient. That assumes that your server/service is threatened by an individual end user compromise, which is not always the case.
Insofar as your users wish for their own account to be protected, it is their "fault" if they do not choose a sufficiently strong password, regardless of the policies in place.
If enough accounts are compromised, then "fault" is determined by who spins their view to the media faster and more effectively.
It's really an area where you can lead a horse to water, but you can't make them drink. Draconian password policies usually cause security to leak in some other direction, such as writing passwords down or relying on guessable non-alpha sequences such as birth dates. Missing password policies lead to weakest link problems, as someone will always pick 'secret' as their password given the choice.
"fault" is a pretty nebulous concept here. You could ask about legal liability, which is firmer. I believe there's been a case or two involving bank passwords that were compromised the the bank was blamed for not requiring sufficient protection, but I don't recall the results.
Actually, there's a fascinating example that I saw last week. A non-profit lost $70k when someone got passwords for their banking and leveraged them.
“We had declined some of the security measures offered to us, [but if]
we had those in place this wouldn’t have happened to us,” French said.
“We thought that would be administratively burdensome, and I was more
worried about internal stuff, not somebody hacking into our systems.”
MECA has since added more security features to its online banking
account, and access to that account is only possible through a
locked-down, dedicated computer.
“All of this is a day late and a dollar short, I guess,” French said.
“Why isn’t someone out shouting on the rooftops about this fraud?
People need to understand how exposed they are.”
That illustrates peoples' attitudes toward password security right there. "We declined to strengthen our security... why didn't someone tell us to strengthen our security?!?" How far are they from suing their bank for not requiring better security?