I’m also infosec. I understand the point you’re making, but humor me for a moment.
Your boss, the CEO, who needs help logging into his email when his browser cache expires, asks for your help.
He sends you a couple of tweets made by a user with a large following claiming that their account with you got hacked because someone used their compromised Instagram password to make unauthorized changes in your system.
Do you:
Create a ticket to investigate the breach so you can proactively stop it from happening again, or
Explain that the end user had gaps in their own security process, and there is not a vulnerability in your system that needs to be addressed.
Yes, the user was hacked. Yes, the users account was taken over. But it was because THEY messed up, not because the system did. If I went and made 200 copies of my house key and dropped them around town with my address on it, and then I get home from work to an empty house, did my home get broken into? Do I have a case against Kwikset because their lock was compromised leading to my stuff being stolen?