is the Compnay to blame for not should and could secure better their server?

If one of my dogs bites the hand of a child provoking it then I'm to blame because it is my dog and wheather the parent wants to accept it or not the parent is responsible for the child's actions.

Likewise you put some code out there in the wild and it bit someone. You are repsonsible for what your code did.

It might well be in the "company's" best interests to better secure their servers and not letting you upload un-verified CGI to their servers may be a futre step they may opt to take.